There’s no point to trying to fix the server in-place. Wipe it down to bare metal and re-deploy from source control.
Once someone has gotten into your boxes, there’s no way to ensure they’re really gone unless you burn it all down. There’s certainly no magic command that can figure it out for you.