How did the shell get on the server?

Question

Malware

Hello.
We got a shell on the server, which connected some file to all index php files. The site is made on bitrix and the connected file was in the upload folder.
I'm assuming that the file was just uploaded by a simple form.

Answer 1

• Check if fail2ban is installed and working correctly
  
• Add a new user with root rights, block access to the root user
  
• Change all passwords.
  
• Check directory permissions.
  
• Add a .htaccess file to the directory with image files with rules that disable PHP in this directory, and display all scripts as HTML.
  For example:
  

php_flag engine 0
AddType "text/html" .php .cgi .pl .fcgi .fpl .phtml .shtml .php2 .php3 .php4 .php5 .asp .jsp

Install mod_security and activate the necessary rules. (along the way, you can add mod_evasive - it will not be superfluous)

Answer 2

You are guessing wrong. Most likely:
1) Picked up the password for FTP
2) Picked up the password for SSH
3) Picked up the password for the admin panel
4) Uploaded the file to the folder for uploading pictures, for example

Answer 3

Use auditd to know where Shell came from and who is modifying files. Keep audit logs as long as possible.
In this situation, in order to find out where the shell came from, you will most likely have to guess on the coffee grounds and search the web server logs by the date the shell file was modified.