In Figure 3 you can see what looks like a webshell. They probably found a way to upload php files to the server which allowed them to do anything. Alternative

In Figure 3 you can see what looks like a webshell. They probably found a way to upload php files to the server which allowed them to do anything. Alternatively, they might have guessed the password and then uploaded the file from the web gui.