Weaponized Web Shell: weevely3

Weevely is a command line web shell dynamically extended over the
network at runtime designed for remote administration and pen testing.
It provides a weaponized telnet-like console through a PHP script
running on the target, even in restricted environments.

The low footprint agent and over 30 modules shape an extensible
framework to administrate, conduct a pen-test, post-exploit, and audit
remote web accesses in order to escalate privileges and pivot deeper in
the internal networks.

The modules feature:

  • Shell/PHP telnet-like network terminal
  • Common server misconfigurations auditing
  • SQL console pivoting on target
  • HTTP traffic proxying through target
  • Mount target file system to local mount point
  • Conduct network scans pivoting on target
  • File upload and download
  • Spawn reverse and direct TCP shells
  • Bruteforce services accounts
  • Compress and decompress zip, gzip, bzip2 and tar archives

Weevely Discussed Before

The backdoor agent

The remote agent is a very low footprint php script that receives
dynamically injected code from the client, extending the client
functionalities over the network at run-time. The agent code is
polymorphic and hardly detectable by AV and HIDS. The communication is
covered and obfuscated within the HTTP protocol using steganographic
techniques.

Download & Read More:

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

Blind SQL Injection Tutorial to Hack a Website

In the previous article, we have the basics of SQL Injection; what SQLi is and what are the types of SQL injection. And, In...

What is SQL Injection? Tutorial: Type and Example

What is SQL injection, and what are the types of SQL injection? These are the common questions, and we will seek the answer to...

Are Cisco 300-410 Exam and Its Related Certification Your Pathway to Career Success? Find Out about This

Introduction Career success can mean different things to different people. For some, it could mean having a prestigious title and for others, it could be...

How to Hack Windows 10 Password Using FakeLogonScreen in Kali Linux

This article demonstrates an in-depth guide on how to hack Windows 10 Passwords using FakeLogonScreen. Hacking Windows 10 password is an exciting topic and...

LOOKING FOR HACKING RECIPES FORM THE PRO?

Then sign up for FREE to the ehacking’s exclusive group. You will get the exclusive tips/tricks, tutorials, webinars & courses that I ONLY share with my fellow on this exclusive newsletter.