StealMyBitcoin-PoC

Also, unless I am reading this wrong, it does not seem like what actually got the bitcoin was a 2shell-like exploit? Seems like memory corruption leading to printing out the flag through just http requests? How would you use this outside of a CTF context? https://github.com/KillaBoi/StealMyBitcoin-PoC

> A1 — Memory Exhaustion (~383MB): I'm actually somewhat surprised at the clumsiness here. I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it. DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - https://github.com/KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests. Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.

> it's not that easy to exploit. With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters. The related public challenge (https://github.com/KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.

More details about stealmybitcoin in LiveOverflow's video: https://www.youtube.com/watch?v=VhNiMWtOutw This is the winner: https://github.com/KillaBoi/StealMyBitcoin-PoC The challenge website was not exploitable at launch because it wasn't actually running PHP; it got cracked in two hours aftewards In the video, LiveOverflow shows his exploit that reliably gets RCE from two requests.

yes it is me :> if you want the poc, it's here https://github.com/KillaBoi/StealMyBitcoin-PoC