How to Slip a Backdoor into PHP Websites with Weevely « Null Byte :: WonderHowTo

Backdoors are convenient to leave behindonce you've already found a way into a server, and they can come in handy for a variety of reasons. They're good for developers who want a quick way into machines they're working on, or for systems administrators who want similar access. Of course, backdoors are also a hacker's best friend, and can be added in a variety of ways. One good tool for doing this is Weevely, which uses a snippet of PHP code.Weevely will create a terminal on the target server and allow for remote code actions via a small footprint PHP agent. It includes more than 30 modules for administration and maintenance needs, as well as privilege escalation and even network lateral movement. Think of those hosting accounts you use that lock down your access—this can come in handy there, as well as on other servers you've successfully infiltrated.In this guide, we'll be taking it for a spin on our localhost. You can follow along, or you can get it running on another server where you can do a lot more with it.Step 1: Download WeevelyWeevely can be found built into some Linux distributions, such as Kali. If it's not installed in your Linux system, you can find version 3 onEpinna's GitHub page. To get it installed on a standard Linux distro, there are a variety of ways you can acquire it, includingGit, HTTP, and wget.Download the Git file:https://github.com/epinna/weevely3.gitDownload via HTTP right now in your browser:https://github.com/epinna/weevely3/archive/master.zipDownload via wget (in your terminal):wgethttps://github.com/epinna/weevely3/archive/master.zipIf you're running Kali, you can skip this step, obviously.Step 2: Create the PHP SnippetNo matter how you've grabbed the Weevely download above, make sure you have a terminal or shell window open in the directory containing thatmaster.zipfile. Assuming you've downloaded it to your Downloads folder, let's go there, unzip the file, change into that unzipped folder location, and do a quick listing to check out the files.cd Downloadsunzip master.zipcd weevely3-master/lsYou should run theweevely.pyset-up file alone to get an idea what's going on here, because the script requires specific syntax, and you can learn about it here../weevely.pyFor our example, we'll be using the "Generate backdoor agent" option. Let's make our passwordpazzWurD, and call our PHP file pathbackdoor.php. We should end up with a file calledbackdoor.phpin the same directory where we're working.Please note that backdoor.php isnot a good namefor your PHP file. This is just an example. You don't want to draw too much attention to what you're doing, so make sure to replace both "mypassword" and "myfilename.php" below with something less obvious../weevely.py generate mypassword myfilename.phpStep 3: Slip in Your BackdoorArmed with this new PHP script (backdoor.php, in our case), we can now consider a few ways that we can use it. First, if you have access to a server, you can simply copy/paste the contents of your PHP file into another accessible PHP file on the server. For example, aconfig.phporsettings.phpfile that might be found there. First, I'll copy the contents of mybackdoor.phpscript with a text editor.Then, I'll paste that entire block of PHP code below all the other PHP code on a file running on my server. Here, I'm pasting it below everything in my server'sinfo.phpfile. I had to use the Vi editor on my server, but if you're little rusty on Vi/Vim, there's a guide here on Null Byte that can help you out:Don't Miss:An Intro to Vim, the Unix Text Editor Every Hacker Should Be Familiar WithMy info.php will still work as usual, but the script below will remain quite until called upon.Another thing you might try is to find a vulnerable website with upload abilities—the kind that lets you share a file or image. Do that, get the link to your file, and you're in business.Most sites like this will block uploads of scripts, but not every site is perfect.Any way you do it, you want to get yourbackdoor.phpfile—or the contents of your PHP file—into some other PHP file, on some local or remote server. Once you've done that, it's time to call on it.Step 4: Access Your BackdoorThe first thing about Weevely that you may notice is that yourbackdoor.phpfile running in the web directory, or on the tail end of some other PHP file, doesn't do or show anything in your web browser. That's good! Were this showing up on a site, it would be discovered right away and patched, or possibly exploited by someone else, and we don't want that.Nothing shows at the bottom of my info.php file, which is what we want.What we want to do is openweevely.pyon our system again, only this time we're not going to create a file with it—we're going to use it to target the place we put the script that we already created. On my localhost server, with my file, this means:./weevely.py http://localhost/info.php pazzWurDIf you're not testing this out with localhost, it'd be something more like:./weevely.pyhttp://some.websitename.com/myfilename.phpmypasswordEither way, use Weevely to call out your file and you might see it answering:Sing with me... "I've Got the Power!"Simply typing:helpat this point will show you all the things you're able to try right out of the box.Weevely has more than 30 modules built in, so there's a lot to work with here. For example,file_lsdoes exactly what you'd think, andfile_cpmight let you copy a file as long as you have worked out yourfromandtopaths just like on a local system. You might be able to grab a whole lot at once withfile_tar, then usecpto have a lot of reading.There are ways to elevate your rights from within Weevely, so if you have elevated rights on the server, you can do basically everything with it. You might be able to get a few clues on your target system withaudit_password. Just remember to stay on the down-low here, to both save yourself time and effort if you're messing with your own system, and to remain quiet if on other systems.TroubleshootingDid you run into any errors during this exercise? I'm running on a new system that's a bit bare-boned, so while I was able to unzip the master.zip directory and see the files it contained, I was not initially able to get Weevely's Python script to run correctly.So if you run into the same issue and see something like this:ImportError: No module named prettytableJust run something like this, replacing the module name with whatever one is missing:$ sudo apt install python-prettytableIf you have any more issues running this script as a backdoor, let me know in the comments below, and I'll see what I can do.Don't Miss:How to Create a Nearly Undetectable Backdoor with CryptcatFollow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by EvilToddler/Null ByteRelatedHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityHow To:SQL Injection Finding Vulnerable Websites..How To:Use PHP to design and make cool websitesHow To:Develop a social networking community website with PHP, MySQL & ActionScript 3News:What REALLY Happened with the Juniper Networks Hack?PHP for Hackers:Part 1, Introduction and Setting UpHow To:Successfully Hack a Website in 2016!Hacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHow To:Use HipHop for PHP to improve website performanceHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordNews:Links for Gifts and Building RequestsHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)News:Nursery Barn ExpansionNews:Super Mega Slip N' Slide!How To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitHow Null Byte Injections Work:A History of Our NamesakeNews:FarmVille Orchard and Tree Gifting LinksNews:Dirt DiverNews:SlipKnot and Incorrect Foundation Chain CountGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsStock Photo Challenge:Animal Totem PoleStock Photo Challenge:Baby DollNews:addd meee