Show HN: Steal My Bitcoin (stealmybitcoin.com)

If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'

That's pennies for something like this.

Add two zeros and it might get nabbed.

Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.

Clearly people aren't cynical enough.

I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.

OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.

https://news.ycombinator.com/item?id=50188948

I am still waiting for them to put their money where their mouth is.

For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol

These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.

Regardless, I'm guessing the smart hackers aren't going to bother.

Given there are public patches and explanations of the issue, isn't it a little late to try to keep this under wraps?

Over a day or two we'll see whether people have an exploit - if more than a few people do, someone will claim this $1k soon. Out of curiosity, what do you plan to do with your exploit that you're holding back?

The fact that you keeping your exploit secret means anything already proves their point.

Also, this site runs Nginx with PHP-FPM, not Apache, which is harder than using mod_php exploit mode for this exploit.

So you would need to develop a working exploit chain and then essentially "burn" it by exposing it to the site owner.

In other words, someone is offering $500 for a working exploit chain.

Is the trap theory that this server isn’t really running a vulnerable version of php, and is instead recording all traffic?

Had it, though? If it was in the wild at day -1, surely some script kiddie will be happy to run that exploit at day +4, because if they didn't someone else would.

There were many people saying things with great confidence and this is one interesting way to gauge what was behind those words.

And then there's the third option that actually this server is unexploitable or there's no wallet or something and simultaneously you give someone the exploit and lose your credibility at the same time. Really no good way out huh?

There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.

So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

It is just kind of fun to poke at something like this.

> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?

I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).

> The difference is we know not to.

Borrrrinnnggggg

Sure you can.

I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?

Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.

You seem to imply there's some economic reason such a white-hat hacker wouldn't take the $500 but don't actually say what it is.

I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?

> I, and many of my friends and cooks could take this easily.

Extreme doubt.

Now it's only worth it to hack a website that's asking to be hacked if the prize is $15k.

No, you couldn't.

> https://stealmybitcoin.com/ This is a CTF for the new PHP vulnerability. Try to find what php version it runs.

(eventually figures it out)

> OK, now get the flag

I'll go for RCE, carefully — the author explicitly invites this, and I'll keep probes minimal.

2. This CTF is using nginx which has a `client_max_body_size=1m` limit. My exploit right now requires more, but I will give it a try (aka ask Codex).

3. You can setup a server with `docker run php:8.5.11-apache` with any of the over 400 vulnerable `php` apache images and give me the IP.

It can only show you if someone has used an exploit against this server.

No, it's a not a zero knowledge proof. But if the site owner is a generally trustworthy person, then I feel that this effort is strong proof the exploit is not trivial.

“Look! A hundred dollars!” he says, bending down to pick it up.

“Don’t bother,” says the other. “If it were real, someone would have picked it up already.”