Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!
The server is getting overloaded, so here's the text for reference:
Steal my Bitcoin
0.65 hours without a successful hack
There is a bitcoin key hidden on this server worth about $502.
It is accessible to the PHP user account through the print-flag binary.
This PHP version was selected from before the PHP2SHELL CVEs were released.
First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
Challenge wallet
Explorer ↗
bc1qlnu5…t3cxqy
0.00625104 BTC
≈ $502.35 USD
stealmybitcoin.com · Terms of participation
Great way to inject some price information into the “AI automates exploits at scale” narrative. “AI can now chain complex exploits, it’s point-and-click pwnage, you say? Over or under $500 a pop?”
For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol
These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.
Regardless, I'm guessing the smart hackers aren't going to bother.
This will go unclaimed for a bit. It may still get claimed within the day, but
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here
If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.
You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.
Sure. Also, we have to trust owner of the site. So it cannot show anything, strictly speaking.
Still, it maybe puts a price on exploit demo. Some say "it goes around twitter", "bots are probing and exploiting it", "it's a biggest thing ever in cybersec history, invest in AI now". Some say "it's a fud".
Are these 500$ laying on a ground for anyone to take?
Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!
Appreciate the commitment to the bit!
I love it, very fun.
Nice CTF! I hope if it's captured by a LLM we'll get a write up as to how it did it.
The server is getting overloaded, so here's the text for reference:
Great way to inject some price information into the “AI automates exploits at scale” narrative. “AI can now chain complex exploits, it’s point-and-click pwnage, you say? Over or under $500 a pop?”
" All traffic is logged."
For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol
These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.
Regardless, I'm guessing the smart hackers aren't going to bother.
Author is a genius troll.
This will go unclaimed for a bit. It may still get claimed within the day, but
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
Make it $15-25k and it’ll get yoinked instantly.
>and handing over a functional exploit
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
> I, and many of my friends and cooks could take this easily.
Sure you can.
I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here
If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.
It's worth it to someone.
> But to what end?
It is just kind of fun to poke at something like this.
> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).
> The difference is we know not to.
Borrrrinnnggggg
You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.
That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.
A reminder that this cannot falsify the existence of an exploit, trivial or otherwise.
It can only show you if someone has used an exploit against this server.
It cannot even show that. The server can lie (trivially).
Sure. Also, we have to trust owner of the site. So it cannot show anything, strictly speaking. Still, it maybe puts a price on exploit demo. Some say "it goes around twitter", "bots are probing and exploiting it", "it's a biggest thing ever in cybersec history, invest in AI now". Some say "it's a fud".
Are these 500$ laying on a ground for anyone to take?
If someone did have a working exploit, is $500 enough for them to give it away to whomever is monitoring this honeypot?
Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)
I remembered that there was a similar challenge for Heartbleed.
I was wondering how exploitable this was. I will definitely be watching.
It runs PHP 8.4.26 (and nginx). Might be useful for others.
Interesting idea! Would like to know how much time need to spend.
this should be done on one of those barebone servers that run on an 8bit commodore or an atari (self identifying as something else)
You have to be really confident that the PHP RCE is not anything serious, 500$ is quite a bit?
It's more like they're offering $500 to be taught how to utilise the exploit.
I'm sure OP is a good person.
But if they were not, and had ill intentions, they might see $500 as a very inexpensive way to purchase a working exploit to use against others.
There’s a lot of techies on this site for whom that’s peanuts.
They should consider donating to the PHP Foundation
$500 isn’t worth the time, make it at least $5k then we talk.