Why does a file named "lgaetz.php "keep appearing in FreePBX distro HTML folder?

[jerryriggin]

The file says it is 1kb but if you open it and close it is is 0KB. Have I been hacked?

[dobrosavljevic (Igor Dobrosavljevic)]

Yes, that’s an indicator of compromise.

[jerryriggin]

Any idea how I’m getting compromised?

[dobrosavljevic (Igor Dobrosavljevic)]

This was a discussion about this from a year ago:

Inactive Stasis app 'hey' missed message

I’m seeing this on two of my servers after the latest updates to core and framework. Oddly though I don’t see this on other servers. The two in question are both running Zulu, Sangoma connect and phone apps. These are also the only ones running VPN for remote phones. I do have a couple others running the same without the VPN component and they do not have this message spamming the console 3 or so times a second. Does anyone know what this app hey is?

[jerryriggin]

My ARI passwords are unique and I don’t have a stasis app “hey” running or created. So any ides HOW lgaetz.php got written into my web root? This is a very serious security issue!

[dobrosavljevic (Igor Dobrosavljevic)]

I wouldn’t have a guess. That is the last time this was being reported and there isn’t any other instances of this happening reported by anyone else that I am aware of.

When did you change your ARI Password? Was it way after these breaches were initially reported last year? When did you apply the relevant patches?

You’ll need to establish the time line of your system and how it correlates to the reported security breach/incident and the response from Sangoma to the report.

If you are not sure how to forensically research a breach event then maybe hiring a specialist is the next step if this is running in any sort of business environment.

[jerryriggin]

I changed all the password when I got the ARI password notification. I have since upgraded these systems to FreePBX 16 and they all have different ARI passwords.

@lgaetz Do you know where the lgaetz.php file comes from or how it got in /var/www/html which is only writeable by root? It has the contents “https:// t. me/+2YOda50Cw4RiZWJk” (spaces added as the url displays as “Telegram: Join Group Chat" in post.)

[dobrosavljevic (Igor Dobrosavljevic)]

It is possible that your system was compromised prior to you making the changes and they have since established a backdoor that allowed them to access your system even after things were patched and changed.

That’s really something you would need to hunt down on your specific system.

You may need to backup your current configuration, install FreePBX on a completely new system and then restore your configuration to ensure that there is no persistent footholds present on the system that you lost trust in.