Sunday, 10 November 2024
Backbox Vulnerability Analysis Web Application

Weevely3 – Weaponized PHP Web Shell

Weevely is a command line web shell dynamically extended over the network at runtime designed for remote administration and pen testing. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted environments.
The low footprint agent and over 30 modules shape an extensible framework to administrate, conduct a pen-test, post-exploit, and audit remote web accesses in order to escalate privileges and pivot deeper in the internal networks.
The weevely modules ecosystem provides a working shell interface even with no shell command execution, replacing the standard shell commands (e.g. the file editors, cd and ls, SQL cli and dump, compression utilities, port scanners, etc.) with the weevely modules.
The weevely wiki tutorials shows some example on how to edit remote files, harvest and reuse some SQL credentials or bruteforce them. Who wants can follow also the tutorial about developing new modules.
Weevely can be extended to automatize the auditing or privilege escalation tasks, exploit specific vulnerabilities, enumerate accounts, scrape sensitive data, pivot on the target to scan the internal networks, run HTTP or SQL requests and do a whole lot of other cool stuff.
Weevely is installed by default on BackBox, download it now or get your version of weevely here.
Feature:

  • Shell/PHP telnet-like network terminal
  • Common server misconfigurations auditing
  • SQL console pivoting on target
  • HTTP traffic proxying through target
  • Mount target file system to local mount point
  • Conduct network scans pivoting on target
    File upload and download
  • Spawn reverse and direct TCP shells
  • Bruteforce services accounts
  • Compress and decompress zip, gzip, bzip2 and tar archives

The backdoor agent
The remote agent is a very low footprint php script that receives dynamically injected code from the client, extending the client functionalities over the network at run-time. The agent code is polymorphic and hardly detectable by AV and HIDS. The communication is covered and obfuscated within the HTTP protocol using steganographic techniques.
Modules development
Weevely also provides python API which can be used to develop your own module to implement internal audit, account enumerator, sensitive data scraper, network scanner, make the modules work as a HTTP or SQL client and do a whole lot of other cool stuff.
Installation
For Linux, the following example runs on a Debian/Ubuntu derived Linux environments with Python version 2.7.

# Make sure that the python package manager and yaml libraries are installed
sudo apt-get install g++ python-pip libyaml-dev python-dev

Install requirements:

sudo pip install prettytable Mako PyYAML python-dateutil PySocks --upgrade

Generate the backdoor agent

 ./weevely.py 
[+] weevely 3.0
[!] Error: too few arguments
[+] Run terminal to the target
    weevely  
[+] Load session file
    weevely session 
[+] Generate backdoor agent
    weevely generate  

Connect the Agent:

  ./weevely.py http://target/agent.php mypassword
weevely> 

Download Weevely3 at Github

Post Comment