Hosting hack, how to find source of SQL queries?

Question

linux

What we have: Debian-based VDS
Banners were found on the site. Viewing the logs showed that the penetration occurred via SSH: Accepted publickey. This is a separate issue, how the attacker logged in using the key. Access from third-party IPs was closed, no one else entered via SSH or FTP. As a result of searches (by eval, base64, etc.), shell scripts were found (even links to authors in Github). They were successfully deleted, but despite this, SQL queries began to pour into one of the databases, inserting JS code with redirects. The search for some other "left" scripts did not lead to anything, scanners like ai-bolit and Manul did not show anything sensible, studying the access logs did not give anything either. Requests come from a local user: [email protected] (remote access from the left ip is closed to the database).
Question: is it possible to find out the source of SQL queries, some variation of mysql-proxy or something else? Or in what to dig?

Answer 1

There may not be left scripts, one of your scripts can be modified in which the insert function into the database was added.
You need to look at the logs, the modification dates of your files, ideally clean everything, temporarily disable ssh files, clean the database with regulars.
Most likely, either an error in closing, or too large a range is open, or hypothetically, if you go through the VPN, the hacker has taken over access to the VPN and entered the server with his ip, which is unlikely.

Answer 2

It's better to reset the whole system.
If the server is compromised, you can hide in such a way that you can no longer find the ends.

Answer 3

There is a possibility that a web shell remained in the system (that's why a connection goes to the database from [email protected]), which the aibolit and manul did not find, say, an encoded web shell.
Try to search the system for new files that have appeared in the system recently / since the alleged hack, and then look inside these files.