Researcher Hacks Into "Steal My Bitcoin" Server in PHP Security Test
Researcher Hacks Into “Steal My Bitcoin” Server in PHP Security Test
A researcher breached the Steal My Bitcoin server in less than 24 hours! 🚀 James Pavur paid the $2,000 bitcoin prize after confirming the breach in server logs. The challenge tested whether an already-patched PHP flaw could be exploited on a vulnerable server.
With the internet going into panic mode over the PHP vulnerability last week, a security researcher’s challenge to steal bitcoin from his server ended quickly. A fellow researcher cracked the server and claimed the $2,000 prize in BTC in less than 24 hours. Security researcher James Pavur congratulated another researcher known as KillaBoi for solving his challenge on stealmybitcoin.com.
However, Pavur said that he himself “screwed up which key went on the server,” as the recovered bitcoin key did not unlock the advertised funds, even though the server was breached. As the organizer acknowledged the error, he verified the breach in his logs and sent the prize himself. He also hinted that he might offer a new challenge. Originally, the prize was worth around $500, but donations helped to increase it fourfold. While the website claims the server was cracked in 19.28 hours, it appears that a usable PHP page was added only about 3 hours before the win. KillaBoi published technically detailed notes on how he managed to crack the server.
The challenge was designed to test whether PHP2Shell, the already-patched critical flaw, could be exploited in practice. Pavur deliberately used PHP 8.4.26, a version predating the security fixes released on October 21st, so “an attacker” could execute commands on a vulnerable server. Last week, as PHP powers a large share of websites, cybersecurity experts, including those working at the NSA and CISA, urged immediate patching after the October 21st fixes. Additionally, after the PHP Foundation released fixes on Wednesday, it warned about another vulnerability on Friday, urging developers to disable a feature in PHP applications. This time, the vulnerability could allow attackers to execute code on a server under specific conditions.