I would probably document, format and rebuild. Rotate secrets and inform anyone whose data might have been impacted.

Assume they compromised everything they would have access to by running code on the server.