{"id":1954,"date":"2026-10-04T19:59:00","date_gmt":"2026-10-04T23:59:00","guid":{"rendered":"https:\/\/home.woodchuckhunters.com\/blog\/?p=1954"},"modified":"2026-10-04T20:06:22","modified_gmt":"2026-10-05T00:06:22","slug":"they-rooted-my-home-server-so-i-hired-an-ai-to-take-it-back","status":"publish","type":"post","link":"https:\/\/home.woodchuckhunters.com\/blog\/2026\/10\/04\/they-rooted-my-home-server-so-i-hired-an-ai-to-take-it-back\/","title":{"rendered":"They rooted my home server. So I hired an AI to take it back."},"content":{"rendered":"\n

For weeks, my ancient Mac Mini home server had been sluggish, but personal time was always booked with wife and kids projects so I never had time to look into it. Then, while planning firewall and server upgrades at the end of July for Delta Township Utilities, I remembered the CMS installs on that old box of mine were overdue. I ran the updates. The CMS crashed… hard… That was the best and worst thing that could have happened.<\/p>\n\n\n\n

Diagnosing the issue in a time efficient manner meant enlisting Claude, Copilot, and Gemini, and together we found something worse than a crash: a full root compromise, probably dating back to May or June. The way in? Embarrassingly, a reused password on the CMS (Yes, sometimes your tech people reuse passwords and even write them down on sticky notes). SSH being the most obviously dangerous path inside had a fresh, strong password but on the CMS’s I’d figured the worst case was cleaning up spam posts. Turns out admin access plus outdated software is all a hack script needs to inject a web shell then move laterally across the filesystem as the php user. Honestly, I thought web shells were still just a novelty used on April 1st web pranks<\/a>. It’s only luck (and probably obscurity) that the rest of my ancient home networking devices were spared (no one’s putting a web shell on a Nintendo 3DS with a web server).<\/p>\n\n\n\n

Anyway, I lost. The hackers had taken over and zombified my server. I was devastated. Then ANGRY! No one comes into my house and uses my server on their botnet! Time for extreme action: server off, disk pulled, maintenance page up on another piece of hardware (that 3DS was earning it’s keep tonight) with a 3am “fighting hackers” AI photo.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Here’s the part I didn’t see coming. By this point, those wife and kids projects had progressed to hospital time for what would become a two-week stay. Her parents had our kids but I was stuck working my day job and couldn’t visit her until the weekends. I had just enough time to get this restored! I grabbed a spare SSD, installed Ubuntu LTS, and started with Webmin. It turned out to be a solid admin tool, but the wrong job for websites on it’s own. Just when I was about to format and start over with HestiaCP\u00a0(my backup plan), I decided to run a little AI experiment. I’d only ever run AI tools on my desktop, but OpenCode has a “terminal user interface”. I figured if it was competent enough to do coding work on Steam games and Windows config files, maybe it could handle a web server. I already had to format away Webmin; what did I have to lose?<\/p>\n\n\n\n

Within hours: a clean, hardened baseline. Within a week: majority of the old sites were cleaned and migrated. Then we had scripted routine tasks the models could run and report on to be proactive. Within a month: we had a chat server running so I could talk to it from my phone. Within two months: multiple AI agents with delegated jobs, running on a $10\/month OpenCode Go LLM plan.<\/p>\n\n\n\n

The box that got me hacked became the birthplace of my home AI fleet. Desperation, meet inspiration.<\/p>\n","protected":false},"excerpt":{"rendered":"

For weeks, my ancient Mac Mini home server had been sluggish, but personal time was always booked with wife and kids projects so I never had time to look into it. Then, while planning firewall and server upgrades at the end of July for Delta Township Utilities, I remembered the CMS installs on that old […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31,23,17],"tags":[45,37,30],"class_list":["post-1954","post","type-post","status-publish","format-standard","hentry","category-ai","category-career","category-techy","tag-ai-assisted","tag-linkedin","tag-neo-lj"],"_links":{"self":[{"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/posts\/1954","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/comments?post=1954"}],"version-history":[{"count":2,"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/posts\/1954\/revisions"}],"predecessor-version":[{"id":1957,"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/posts\/1954\/revisions\/1957"}],"wp:attachment":[{"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/media?parent=1954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/categories?post=1954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/home.woodchuckhunters.com\/blog\/wp-json\/wp\/v2\/tags?post=1954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}