My webpanel got hacked

[dushLK]

Hi, I had over 300 active miners and my panel just got hacked and the hacker changed the api endpoint url too,

How can this possible?

Please help.

[UnamSanctam]

I don't know, did you change the password or not? Did you make sure there weren't any error logs? And the configuration is only in memory, so on the next restart they will go back to your web panel again.

[dushLK]

I changed the default password to a very complex one. The thing is the db file was readable to anyone. Can a hacker use the db file to gain access? Also what are the things you suggest to keep my panel secure from now on? Thanks.

[UnamSanctam]

The db being readable shouldn't be able to cause that, though it's always recommended to block it in some way. Make sure that your __UNAM_LIB\Logs folder is empty, if there's some problem (file in there) then it should preferably be reported or fixed locally (if the error is due to something local). Error logs can expose sensitive information depending on the error and the web server it's running. Blocking both the db and __UNAM_LIB\Logs folder should ensure that no sensitive information can be leaked.

[dushLK]

Yes. My Lib directory was set to public viewable. I set its permissions. But the issue is even after I changing the password in config, an older browser session can access the website. How can I logout the hacker from the panel?

[UnamSanctam]

There is a directory that contains the sessions somewhere, usually in a /tmp/ folder, if you delete all those then all sessions should be removed.