Alfa Shell V4 “Tesla” is the most polished shell in the Tier 1 corpus. Proper modular architecture, robust error handling, session-based auth that resists automated scanners (returns HTTP 403, not 404). The payload is gzinflate+base64 obfuscated with a plaintext config header in $GLOBALS.
The dominant finding is not a vulnerability. It is a business model.
Capabilities
Full-featured file manager (browse, upload, download, edit, chmod, rename, archive). MySQL/PostgreSQL/SQLite database browser. Command execution via shell_exec, passthru, system. CGI/Perl backdoor installer that drops a persistent reverse shell outside the webroot. FTP brute-force module. Mass defacement module. Server info enumeration. Network scanner.
Default account: the username admin is hardcoded in the plaintext config header — the lever the cookie-logic bypass (below) abuses. The password ehsan is stored as an unsalted MD5 (a6f452ec3293d7fb72c5b677257b20ec = md5(“ehsan”)) in the same header, exposed for offline cracking. The 167 KB alfav4-tesla.php build is fully packed, so its config header is not independently readable; the credential findings are family-level, from the readable sibling build.
Author Surveillance Beacon
Every authenticated page load triggers an eval(base64_decode(...)) chain that resolves to a mail() call to a hardcoded Yandex address controlled by the kit author (Hmei7 group, Indonesian).
The operator deploying Alfa harvests victims. The kit author harvests operators. Triple extraction chain: victim → operator → author. Operators have no visibility into this exfiltration — they are reporting every compromised host back to the supply chain while believing they control the tool.
Vulnerabilities
Three independent attack paths confirmed in isolated testing, two yielding pre-auth RCE:
| # | Class | Impact | Status |
|---|---|---|---|
| 1 | Config bypass — safemode ships as string '0', PHP treats as falsy, auth block silently skipped | Pre-auth RCE | Live-proven |
| 2 | Cookie logic error — AND-vs-OR in cookie check, hardcoded username short-circuits validation | Pre-auth RCE | Live-proven |
| 3 | mail() beacon to author on every authenticated load | Supply-chain surveillance | Live-proven |
| 4 | MD5 hash in plaintext config, no salt, no iterations | Credential exposure | Confirmed |
Both RCE paths exploit the shell’s own eval dispatcher after bypassing authentication. The config bypass fires on every default install — empty('0') returns TRUE in PHP, so the auth block is unconditionally skipped on every copy that ships with default config.
Detection Surface
File-system indicators
| Indicator | Type | Detail |
|---|---|---|
| SHA256 (alfa3) | Hash | 6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306 — alfa3.php, 252 KB |
| SHA256 (alfav4-tesla) | Hash | 85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90 — alfav4-tesla.php, 167 KB |
| Distinct files | Note | alfa3 and alfav4-tesla are DIFFERENT files (different hash AND size) — not the same payload |
create_function( | Code pattern | Obfuscation — removed in PHP 8, silent 0-byte on PHP 7.4 |
KeluargaHmei7@yandex.com | String | Author surveillance beacon — mail() on every authenticated session |
$tujuanmail | Variable | Target email variable for Hmei7 beacon |
$pesan_alert | Variable | Alert message variable for beacon |
| Default account | Auth | Username admin hardcoded, password ehsan — unsalted MD5 a6f452ec3293d7fb72c5b677257b20ec (from readable alfa3.php build) |
alfa3.php filename | File name | Sibling Alfa variant — DIFFERENT hash/size from alfav4-tesla.php (see above), packed independently |
| Runtime | PHP 5.6 only | create_function removed in PHP 8 |
HTTP access-log indicators
| Log pattern | What it means |
|---|---|
POST pass= | Login form |
Outbound mail() to KeluargaHmei7@yandex.com | Author surveillance beacon fires on every authenticated session |
create_function( | Obfuscation mechanism (PHP 5.6 only — removed in PHP 8) |
Response: Alfa Shell in page | Shell title |
Default account: username admin, password ehsan | Unsalted MD5 a6f452ec3293d7fb72c5b677257b20ec in plaintext config |
YARA rule
import "hash"
rule webshell_alfa_v4_tesla {
meta:
description = "Alfa Shell V4 Tesla (anchors on Alfa-specific markers; the shared Hmei7 beacon is covered by webshell_hmei7_beacon)"
author = "OHIIHO Threat Research"
reference = "https://research.ohiiho.com/arsenal/alfa-v4-tesla/"
status = "validated"
sha256_alfa3 = "6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306"
sha256_alfav4_tesla = "85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90"
strings:
$alfa_title = "Alfa Shell" ascii nocase
$alfa_team = "Alfa_Team" ascii
$solevisible = "solevisible" ascii
$config_global = "$GLOBALS['OWtTcBmdOd']" ascii
$tujan_mail = "$tujuanmail" ascii
$pesan_alert = "$pesan_alert" ascii
$create_fn = "create_function" ascii
$eval_b64 = "eval(base64_decode(" ascii
condition:
filesize < 300KB
and (
// source-form shell: an Alfa marker together with a PHP code marker
// (the AND excludes Alfa readme/notes .txt that merely name the shell)
(($alfa_title or $alfa_team or $solevisible or ($tujan_mail and $pesan_alert))
and ($create_fn or $eval_b64))
// alfa3 packed instance — unique obfuscated global
or $config_global
// opaque packed instances — no usable plaintext signature, hash-anchored
// (filesize == guard so the SHA256 is computed only for the exact candidate)
or (filesize == 252175 and hash.sha256(0, filesize) == "6f13fa5a8e42bfdd127f17410bde002872de149b47e9153fb5b36ba007341306")
or (filesize == 167465 and hash.sha256(0, filesize) == "85d88d15687c7a98941143f370ea61a98bf73248df2369000f02aefe8443fd90")
)
}
This rule requires libyara built with the hash module (standard / OpenSSL-enabled) for the hash-anchored packed variants.
The Hmei7 supply-chain beacon is detected by the generic webshell_hmei7_beacon rule:
rule webshell_hmei7_beacon {
meta:
description = "Hmei7 (KeluargaHmei7) supply-chain mail beacon injected into redistributed PHP shells/uploaders"
author = "OHIIHO Threat Research"
reference = "https://research.ohiiho.com/arsenal/"
status = "validated"
severity = "high"
strings:
$hmei7_b64 = "JHR1anVhbm1haWwgPSAnS2VsdWFyZ2FIbWVpN0B5YW5kZXguY29t" ascii // b64 "$tujuanmail = 'KeluargaHmei7@yandex.com"
$hmei7_mail = "KeluargaHmei7@yandex.com" ascii
condition:
filesize < 500KB
and ($hmei7_b64 or $hmei7_mail)
}
MITRE ATT&CK
| Technique | Context |
|---|---|
| T1505.003 | Web Shell |
| T1041 | Exfiltration Over C2 Channel (mail beacon to Hmei7) |
| T1027 | Obfuscated Files (gzinflate+base64+create_function) |
OHIIHO Threat Research.