Weevely is a weaponized web shell designed for post-exploitation access to compromised web servers.
The tool addresses the need for persistent remote access and control following successful web server compromise. It works by uploading a small polymorphic PHP agent to the target server, which communicates with the operator through obfuscated HTTP requests. Once deployed, the agent can be extended at runtime with additional modules without requiring re-upload, allowing operators to add capabilities on demand.
The tool suits penetration testers and red teamers conducting post-exploitation activities on web infrastructure. It provides over thirty modules covering administrative tasks, persistence mechanisms, reconnaissance, privilege escalation, and lateral movement into target networks. Key capabilities include interactive shell access, SQL console functionality with pivoting, HTTP/HTTPS proxy operation through the target, file transfer, reverse and direct shell spawning, security auditing, port scanning from the target, remote filesystem mounting, and SQL credential brute-forcing. The polymorphic nature of the PHP agent and obfuscated communication protocol are designed to evade antivirus detection.
The project shows consistent maintenance with regular updates addressing functionality and security. Development activity demonstrates ongoing refinement of existing features and modules rather than major architectural changes. The codebase receives periodic improvements to the agent generation and communication mechanisms. Community engagement through the wiki and documentation suggests active use and feedback incorporation.
