WeBaCoo

WeBaCoo (Web backdoor cookie script kit) provides scripts for creating web backdoors using cookies, with module support. It enables penetration testers and security researchers to generate PHP backdoor code that hides commands within HTTP cookies, allowing stealthy remote code execution on compromised web servers. The tool supports various PHP system functions and offers options for obfuscation to evade detection.

Primary use cases include post-exploitation scenarios where maintaining access to a web server is needed without deploying traditional shells. Users can generate custom backdoors, connect to them for interactive terminal sessions, or execute single commands remotely. The kit is particularly useful in web application security assessments requiring persistent, cookie-based access methods.

It operates through HTTP methods (GET by default) and supports proxies like Tor for anonymity, logging, and verbose output for debugging. Dependencies include Perl libraries for socket handling and URI parsing.

WeBaCoo generates PHP backdoor code that processes commands embedded in HTTP cookie values, using specified system functions like system(), shell_exec(), or exec() to execute them on the server. The backdoor employs delimiters to parse cookie data and supports obfuscation for evasion. For interaction, it sends HTTP requests with commands in cookies to the backdoor URL, capturing output from responses. Remote terminal mode establishes a persistent session, while single command mode executes one-off instructions. Proxies and custom user-agents enhance anonymity, with random delimiters per request adding variability.