Show HN: Steal My Bitcoin

TacticalCoder

Nice CTF! I hope if it's captured by a LLM we'll get a write up as to how it did it.

sashank_1509

You have to be really confident that the PHP RCE is not anything serious, 500$ is quite a bit?

hau

That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.

earthpyy

Interesting idea! Would like to know how much time need to spend.

nayuki

The server is getting overloaded, so here's the text for reference: Steal my Bitcoin 0.65 hours without a successful hack There is a bitcoin key hidden on this server worth about $502. It is accessible to the PHP user account through the print-flag binary. This PHP version was selected from before the PHP2SHELL CVEs were released. First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org. All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private. Challenge wallet Explorer ↗ bc1qlnu5…t3cxqy 0.00625104 BTC ≈ $502.35 USD stealmybitcoin.com · Terms of participation

jackdecker

Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)

jerrythegerbil

This will go unclaimed for a bit. It may still get claimed within the day, but People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just… The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all. That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play? I, and many of my friends and cooks could take this easily. The difference is we know not to. Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.

randomblock1

It runs PHP 8.4.26 (and nginx). Might be useful for others. Also, the only pages I found are static and not an actual PHP entry point. If it doesn't run any PHP, it's not vulnerable to PHP2Shell. At least I think that's how it works.

primer42

If someone did have a working exploit, is $500 enough for them to give it away to whomever is monitoring this honeypot?

Stevvo

You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.

LandoCalrissian

I love it, very fun.

tamimio

$500 isn’t worth the time, make it at least $5k then we talk.

datadrivenangel

Appreciate the commitment to the bit!

impure

I was wondering how exploitable this was. I will definitely be watching.

rvba

this should be done on one of those barebone servers that run on an 8bit commodore or an atari (self identifying as something else)

qbane

I remembered that there was a similar challenge for Heartbleed.

technion

There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading. It clearly isnt happening.

v3ai

major pain in the neck that anthropic doesn't let opus 5.5 work on this, goes back to 4.8 lame

Izmaki

This has to be the cheapest way to obtain a working POC. Lol!

int32_64

It could be an interesting cybersecurity technique to hide obvious crypto private keys all over. If it gets swept you are breached.