Hacking a site on Joomla by an attacker, how to understand - where is the hole?

Question

Joomla

There are several sites on Joomla 2.5.6, recently I found that index.php and index.html were replaced with pages of some kutzhacker from Indonesia. I killed them, returned the old pages to their place, but the question arose - how was the hack carried out and how to close the hole?
The passwords are complex, and it looks like the sites themselves were not hacked, but somehow the attacker was able to delete my files from the root folder and upload his files there.
Are there any tools for such analysis?

Answer 1

For starters, you should remember the date and time when those files were modified. Map ssh/ftp connections to the server at this time. If there is no obvious correlation, analyze recent POST requests to the server, select from them "unusual" ones for your site, and it is better to log POST requests with saving all the parameters passed.
For example, write the following script:

<?
if(isset($_POST) && count($_POST)>0){
        $data="";
        foreach($_POST as $key=>$val){
                if(is_string($val) && strlen($val)>2000 )
                        $val=substr($val,0,2000);
                $data.=$key."=>".$val."\n";
        }
        $fp=fopen("/path/to/log/dir/".$_SERVER['HTTP_HOST'].".log","a");
        fwrite($fp,date("Y-m-d H:i:s")." ".$_SERVER['REMOTE_ADDR']."\n".$data."---------------------------\n");
        fclose($fp);
        $data="";
        reset($_POST);
}

And add to apache:
Thus, in case of a repeated attack, having seen the change time of your index.php, you will be able to correlate the change time of index.php with a certain set of POST requests, thereby analyzing through which "holes" the attack on the site was carried out.

Answer 2

What is not working on my site, how can I fix it wrong?
https://rusboxing71.ru/administrator/
FTP
u0437785
37!WdC3y
public $dbtype = 'mysqli';
public $host = 'localhost';
public $user = 'u0437785_default';
public $password = 'lJpUL2U_';
public $db = 'u0437785_default';
public $dbprefix = 'tvu0z_';
public $live_site = '';
public $secret = 'drSfTlhij55QMHEt';
public $gzip = '0';
public $error_reporting = 'default';
public $helpurl = ' https://help.joomla.org/proxy?keyref=Help{major}{m... }';
public $ftp_host = '';
public $ftp_user = '';
public $ftp_pass = '';
public $ftp_root = '';
public $ftp_enable = '0';
public $offset = 'UTC';
public $mailonline = '1';
public $mailer = 'mail';
public $feed_email = 'none';
public $log_path = '/var/www/u0437785/data/www/rusboxing71.ru/administrator/logs';
public $tmp_path = '/var/www/u0437785/data/www/rusboxing71.ru/tmp';
public $lifetime = '15';
public $session_handler = 'database';
public $shared_session = '0';
public $memcache_persist = '1';
public $memcache_compress = '0';