Module: "FreePBX Framework", File: "/var/lib/asterisk/bin/freepbx_engine altered"

[ashcortech]

check root’s and asterisk’s crontab file to see if your system has been hit with the rest_apps exploit

K.php - a RestApps malicious script

If you were impacted by the restapps security regression a week or two ago, it is possible you were hit with a php script that is currently labeled “k.php” If you want to see if you were compromised by this script, I’ve included some content below that you can check. I do not claim to have identified everything, but I’m hoping this might help someone. Anyways, here are the places you can look. crontab -e -u root → if this line exists, you’re compromised. DO NOT run this for testing. */1 * …