Can not access WHM - root password has been changed

Question

I think our WHM site hosted on AWS has been hacked. Our root PW has changed and we can not login with via front end or SSH.

We still have access to AWS instance is there a way to access WHM user DB and change password again.

Thanks

Answer

Not being all that familiar with WHM but is it right that the `root` password for logging in to WHM is the same as the `root` password for SSHing into the Linux EC2 host? https://support.cpanel.net/hc/en-us/articles/1500007844462-How-can-I-reset-the-root-password-if-I-don-t-remember-my-current-root-password-

Depending on the AMI that the host is built upon, you may be able to SSH in as `ec2-user` and then `sudo su -` to become `root` that way. From here you can reset the `root` password.

If the EC2 has Systems Manager installed and enabled then you may be able to login as `ssm-user` through that way, and then become `root` with `sudo su -`.

Can not access WHM - root password has been changed

Contenido relevante