In Figure 3 you can see what looks like a webshell. They probably found a way to upload php files to the server which allowed them to do anything.

Alternatively, they might have guessed the password and then uploaded the file from the web gui.