[vorticalbox]

I have a system set up in a VM that is running DB as root and is purposely SQLi , however It also doesn't disclose the file system at all.

So I know that I can read/write files so where do I go from here?
How do I go about finding the /www folder so I can install a back door?

I have downloaded the /etc/passwd file but that isn't giving me the information I am after.

[Rafaelinio]

First of all i think the "/www" folder you are referring to is located at "/var/www"
the /etc/passwd file just contains local users. The file you're probably after is /etc/shadow which contains the systems password but its hashed so you'll have to crack it.
You might also want to add your ssh key in the machines ~/.ssh folder so you can access it at any time through ssh

[vorticalbox]

First of all i think the "/www" folder you are referring to is located at "/var/www"
the /etc/passwd file just contains local users. The file you're probably after is /etc/shadow which contains the systems password but its hashed so you'll have to crack it.
You might also want to add your ssh key in the machines ~/.ssh folder so you can access it at any time through ssh

how do I add a key?

[Rafaelinio]

Generate one on your attack machine using:
root@ubuntu:~# ssh-keygen

Then upload the .pub file that will be generated to the victim machine and append to the authorized keys like so
cat <your public key>.pub >> ~/.ssh/authorized_keys

you can now connect to it using ssh <victims_ip>

anyway you can just google this....

[vorticalbox]

Generate one on your attack machine using:
root@ubuntu:~# ssh-keygen

Then upload the .pub file that will be generated to the victim machine and append to the authorized keys like so
cat <your public key>.pub >> ~/.ssh/authorized_keys

you can now connect to it using ssh <victims_ip>

anyway you can just google this....

Thanks, what if ssh disabled? Seeing as i cant find where the www folder is i have no idea where to write a backdoor.

[Rafaelinio]

How are you gonna write a backdoor if you don't know the basics of linux? grab yourself a book and familiarize with the linux filesystem, commands etc.

[_bengi]

Just write to /etc/shadow. It's really not that difficult.

[vorticalbox]

How are you gonna write a backdoor if you don't know the basics of linux? grab yourself a book and familiarize with the linux filesystem, commands etc.

My problem is finding the www documents, i my have lied in the op its not a vm.

The webserver is running solaris, i tried all the normal www folders and no luck, i guess the next step is to upload a backdoor and run it on the machine rather than via a web folder based on?

[_bengi]

My problem is finding the www documents, i my have lied in the op its not a vm.

The webserver is running solaris, i tried all the normal www folders and no luck, i guess the next step is to upload a backdoor and run it on the machine rather than via a web folder based on?

You can predict the document root with knowledge of the web server software.

[VizOne]

i am stil stuck on finding kernel exploit

[vorticalbox]

You can predict the document root with knowledge of the web server software.

i am stil stuck on finding kernel exploit

I stole /etc/syslog.confg and got this

#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */