I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd party module downloaded from drupal site and installed without the proper revision, some hacker managed to push what looks like a remote access tool in the site's root directory.
I've also found some obfuscated PHP scripts inside the sites/default folder. I've tried running them through http://www.unphp.net/ but no luck, they all look like rubbish:
So far, apart from these PHP files, everything seems in place, but it bothers me that I don't even know what they do.
Just this one
translation-main, seems pretty clear that it is executing code from cookies:
What should I do now? Is there any way I can deobfuscate the code and monitor the hacker(s) activity? I am more interested in learning from this case as much as I can than in securing my server as soon as possible, since there is nothing private or valuable on it.
How this question is different:
I don't care about securing my data
I don't care about finding the attacker
I don't have clients to notify
The passwords and certificates I have used on this server are unique for the server and I have not logged onto any other server from it.
I don't need to stop any hacker, or even disconnect my server from the Internet. I have done it just in case, at least until I have examined the server in detail and concluded I can monitor any further activity, or decided I just have to reinstall.
I have specifics from the kind of attack. It's not: Oh no! Somebody did something in my server! It is: somebody put THIS in my server and I know it is a remote access tool and I have been trying to learn more about it but I am stuck. Can anybody help me figure out how to learn more about it?