poly: generates polymorphic webshells


A python script that generates polymorphic webshells.
Use it to encode your favorite shell and make it practically undetectable.
If no shell is specified with the -p argument, the default shell in the /shells directory is used.

Supported webshells

.asp( vbs )
.aspx( c# )

Supported encoders

b64base64 encoded text with random strings in random intervals
ordord() each character plus a random number
rndeach character is mapped to another random character
rottext is divided by a random number of rows, then rotated 90 degrees clockwise


C99 shell uploaded on virustotal

EncodingDetection rate
none41 / 56
b640 / 52
ord0 / 54
rnd0 / 56
rot0 / 56


git clone https://github.com/grCod/poly.git



Notice :
With asp shells, it is recommended to use the default shell. ( /shells/shell.asp )
Encoded aspx shells may not work on some servers.
Php works pretty much with every shell, on every server.
Rnd and rot encodings are not binary safe. ( may produce unprintable characters )

Disclaimer :
This tool is made for educational and research purposes.
Don’t be evil.

Copyright (c) 2017 grCod

Source: https://github.com/grCod/