Broken FreePBX installation

[Spyd]

I have a FreePBX, I don’t know exactly what version, probably 16, with Asterisk 16.

When I try to access the interface, I get a 404 error.

Asterisk still works as intended, it’s just that I can’t access FreePBX.

I can login as root from the physical machine, I checked the folders and the files are gone, (config.php, for example).

If I try to run fwconsole, I also get an error of PHP files missing.

I tried reinstalling FreePBX using yum, but yum tells me that there’s “nothing to do”.

Then I tried downloading http://mirror.freepbx.org/modules/packages/freepbx/freepbx-16.0-latest-EDGE.tgz, unpacking and running the install.php file, but it fails. I removed the check for being run under fwconsole, but then it errors out telling me that the module FreePBX does not exist.

How can I reinstall or recover the files missing for FreePBX?

Or if there’s a way to run the backup module, then I can do a clean install and restore the Backup, but I need a way to return this FreeBPX to working order.

Any help will be greatly appreciated.

[BlazeStudios (Tom Ray)]

@Spyd

I can login as root from the physical machine, I checked the folders and the files are gone, (config.php, for example).

If you’re missing config.php from the web directory and other files…you have some issues with that machine. Someone removed those things. Is there a proper apache config in /etc/httpd?

If a bunch of your FreePBX files and/or folders are missing either a bad actor or someone who made a serious mistake got into your box and did something.

[Spyd]

AFAIK nobody touched that machine. It’s a dedicated computer, only used as a PBX, last time I had to change the configuration is about a year ago, and nobody said anything because the PBX part works. Only now that I have to change some minor stuff is when I found that there’s no interface.

It’s way more likely the hard disk has a fault than any malicious actor.

In any case when (or if) I get to make FreePBX work again, I’ll make a backup and I’ll restore it into a VM on a way better (and newer) Proxmox server I own, but I don’t want to lose the current config and mailbox data. I have backups, but they’re old and if I can repair that installation It’ll be the preferable option.

[matthewljensen (Matthew Jensen)]

It’s probably worth checking these steps. I’m pretty sure one of the machines I managed had problems running fwconsole commands when it was compromised with this hack (due to the missing/empty freepbx.conf file).

@penguinpbx

• Visit your FreePBX Administrator web interface - is it broken ? Not loading like it used to ? Does /etc/freepbx.conf file still exist - check with this command:
  $ ls -l /etc/freepbx.conf
• Look for the tell-tale leftover sign of the exploit - this file should not exist on normal systems: /var/www/html/.clean.sh So check for it like this:
  $ ls -l /var/www/html/.clean.sh
• Check Apache logs for POST requests to modular.php - reaching back to at least August 21st. A command like the following should help you quickly look through all the relevant logs on both v16 and v17:
  $ zgrep modular.php /var/log/{httpd,apache2}/access*
• Check Asterisk logs for calls to extension 9998 - reaching back to at least August 21st (slight variations in this command may exist between systems):
  $ grep 9998 /var/log/asterisk/full*
• Review MariaDB/MySQL logs and tables for MACD of unknown users in the ampusers table - specifically looking for a suspicious ampuser username in the far-left column:
  $ mysql -e "SELECT * FROM ampusers" asterisk

Full thread:

Security Advisory: Please Lock Down Your Administrator Access

The Sangoma FreePBX Security Team is aware of a potential exploit affecting some systems with the administrator control panel exposed to the public internet. AUG. 28 GOOD NEWS: FIX IS NOW DEPLOYED IN STABLE REPOS FOR AFFECTED SUPPORTED VERSIONS, INCLUDING ALL RELEASES OF ENDPOINT MODULE IN 15, 16 & 17. PLEASE UPDATE! Users are advised to limit access to the FreePBX Administrator by using the Firewall module to limit access to only known trusted hosts. UPDATE 2025-09-09T16:13:00Z (UTC) Trimmed …

[Spyd]

I tried fixing FreePBX, but it ended not working as I wasn’t able to source the correct version of the modules installed, so I ended starting from scratch, downloaded and installed the latest FreePBX, restored an old backup and had to carry over more than a year of changes to the configuration, but just now I almost finished with it.

Thank you to everybody that answered.