Researcher hacks into “Steal My Bitcoin” server in PHP security test
The PHP saga continues.
Image by Jakub Porzycki/NurPhoto via Getty Images
Follow us
- A researcher breached the Steal My Bitcoin server in less than 24 hours.
- James Pavur paid the $2,000 bitcoin prize after confirming the breach in server logs.
- The challenge tested whether an already-patched PHP flaw could be exploited on a vulnerable server.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
With the internet going into panic mode over the PHP vulnerability last week, a security researcher’s challenge to steal bitcoin from his server ended quickly. A fellow researcher cracked the server and claimed the $2,000 prize in BTC in less than 24 hours.
Security researcher James Pavur congratulated another researcher known as KillaBoi for solving his challenge on stealmybitcoin.com.
However, Pavur said that he himself “screwed up which key went on the server,” as the recovered bitcoin key did not unlock the advertised funds, even though the server was breached.
As the organizer acknowledged the error, he verified the breach in his logs and sent the prize himself. He also hinted that he might offer a new challenge.
The challenge was designed to test whether PHP2Shell, the already-patched critical flaw, could be exploited in practice. While the website claims the server was cracked in 19.28 hours, it appears that a usable PHP page was added only about 3 hours before the win.
Originally, the prize was worth around $500, but donations helped to increase it fourfold. Also, Pavur deliberately used PHP 8.4.26, a version predating the security fixes released on October 21st, so “an attacker” could execute commands on a vulnerable server.
KillaBoi published technically detailed notes on how he managed to crack the server.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Last week, as PHP powers a large share of websites, cybersecurity experts, including those working at the NSA and CISA, urged immediate patching after the October 21st fixes.
Meanwhile, as reported by Cybernews, after the PHP Foundation released fixes on Wednesday, it warned about another vulnerability on Friday, urging developers to disable a feature in PHP applications.
This time, the vulnerability could allow attackers to execute code on a server under specific conditions.
