been on this a while… tried sqli with sqlmqp, username enum in ssh and brute forcing… no result to proceed… any hints…

are you getting user.txt or root?

trying to get the user.txt first

You’re looking for all the wrong stuff in all the wrong places. Step back, and enumerate, enumerate, then enumerate some more. Start with a gobuster/dirbuster/dirb/dirsearch and work from there