PE-WEE
weevely
Python tool that generates a lightweight, obfuscated PHP web shell and includes the client to manage it, in one package.
OVERVIEW
Weevely (github.com/epinna/weevely3, the actively maintained Python 3 rewrite of the original weevely project), GPL-3.0 licensed, packages both halves of the webshell workflow into one tool: it generates a small, obfuscated PHP agent file, and once that agent has been authorized and placed on a target, its own client connects to it and presents a Unix-shell-like session with dozens of modules — file transfer, a SQL console, port scanning through the compromised host, and privilege-escalation checks — rather than raw command execution alone.
Its traffic obfuscation is deliberately lightweight compared to an encrypted-channel client, favoring plausible-looking single HTTP requests over a fully negotiated cipher, which makes it a useful, easy-to-audit baseline for a lab environment or a lower-detection-budget engagement where a heavier tool would be overkill.
USE CASES
Practical use cases
- 01
Generating a single obfuscated PHP agent file to place as the authorized post-exploitation implant.
- 02
Running file, database, and network-recon modules through the compromised host from one terminal-style client.
- 03
Using the built-in privilege-escalation checks to see what a low-privileged web user on the host can reach.
- 04
Teaching or demonstrating webshell mechanics in a lab, where its lighter obfuscation is easier to read and explain than an encrypted-channel client's.
QUICK START
Once dropping a PHP web shell has been authorized for a scoped engagement, to generate a small obfuscated agent and drive it from a single terminal-style CLI instead of separate generator/client tools.
- Confirm placing a PHP web shell is authorized for this phase and note the agreed removal deadline.
- Install Weevely (pip install or clone the repo) on the tester's machine.
- Generate the obfuscated agent file with a password, then place it on the target through the already-authorized upload path.
- Connect with the client using the target URL and password to open the module-driven session.
- Remove the agent file from the target once the authorized window ends.
weevely generate <password> agent.phpBEFORE YOU RUN IT
What to check before running it
The generated PHP agent is a known signature for many WAFs and PHP-specific security modules; check whether the client wants raw or additionally obfuscated output before placing it.
Placing the agent must be logged, time-boxed to the agreed window, and removed from the target's filesystem afterward — it's a static file, so a straightforward filesystem audit will find any copy left behind.
Its lighter obfuscation model means it is more likely to be flagged by modern WAFs than an encrypted-channel client — factor that into the detection-evasion expectations set with the client up front.