Steal My Bitcoin CTF proof of concept
A Python script demonstrates a proof-of-concept exploit for the "Steal My Bitcoin CTF" challenge, leveraging a PHP memory exhaustion vulnerability to achieve arbitrary command execution.
Intelligence analysis by Gemini 2.5 Flash
The PoC details a critical vulnerability in PHP's session upload-progress parsing, where specific multipart uploads cause memory exhaustion, leaving exploitable stale data in worker processes. By carefully crafting subsequent requests, an attacker can leak sensitive memory addresses, then inject a forged PHP structure to execute system commands, as demonstrated in the "Steal My Bitcoi…
Imagine PHP, a language many websites use, is like a busy chef in a kitchen. Sometimes, when too many ingredients (data) are thrown at it in a specific way, the chef gets confused and leaves some messy notes (stale data) lying around. A clever trickster, like this script, can read those messy notes to find secret instructions (memory addresses) and then sneak in a fake recipe (forged structure) that tells the chef to do something bad, like run a secret command on the computer.
Analysis
PHP 8.4.26
The core of the vulnerability demonstrated in the Steal My Bitcoin CTF PoC lies within a specific configuration of PHP version 8.4.26. This exploit is highly sensitive to the environment, requiring PHP to be running on Alpine Linux with its built-in CLI server and a specific number of worker processes, typically four. The PoC explicitly highlights that even minor deviations, such as using a Debian-based PHP 8.4.26 stack, would result in a different binary layout, rendering the exploit's calibrated code-pointer fingerprints ineffective and causing the attack to fail at an early stage.
The attack vector leverages a memory exhaustion condition triggered by a specially crafted multipart upload during PHP's session upload-progress parsing. Despite the seemingly small wire size of the upload, PHP is forced to consume significantly more memory internally. When the system runs out of memory mid-process, it fails to properly clean up, leaving behind stale and exploitable state information within the worker process. This residual data becomes a critical stepping stone for subsequent stages of the exploit, enabling the leakage of sensitive memory addresses.
Steal My Bitcoin
The Steal My Bitcoin CTF (Capture The Flag) challenge serves as the practical target and validation ground for this proof-of-concept. CTFs are competitive cybersecurity exercises where participants solve various challenges to demonstrate their hacking prowess, often involving exploiting vulnerabilities in simulated or real-world systems. This PoC provides a comprehensive, step-by-step reproduction of how such a challenge, likely involving gaining control over a system or extracting a "flag" (proof of compromise), was successfully solved.
The exploit chain against the Steal My Bitcoin challenge is meticulously designed, involving a sequence of up to 20 distinct HTTP requests. Crucially, this process is executed without any looping or retries, indicating a high degree of precision and reliability in the crafted requests. The ultimate goal of the exploit is to achieve arbitrary command execution, which, in the context of the CTF, allows the script to send back a fresh proof marker and the result of a print-flag command, signifying a complete and successful compromise of the target system.
KillaBoi
KillaBoi is the individual security researcher and developer responsible for creating and publicly releasing this Steal My Bitcoin CTF PoC on GitHub. The repository explicitly states that the Python script within is a direct reproduction of the request sequence that KillaBoi utilized during their successful completion of the Steal My Bitcoin challenge. This release underscores a commitment to open-source security research, providing a detailed, working example for others to learn from.
The author also draws a parallel to a previous security discovery, a Steam Local Privilege Escalation, which was featured in a video by John Hammond. This reference establishes KillaBoi's background and expertise in identifying and exploiting complex software vulnerabilities. The public sharing of such detailed exploit code is invaluable for the cybersecurity community, offering insights into advanced attack techniques and fostering a deeper understanding of system weaknesses.
Furthermore, KillaBoi openly acknowledges the "ugly" nature of the proof-of-concept script, encouraging other developers and security enthusiasts to refine it or create their own improved versions. This collaborative spirit is a hallmark of the open-source community, where shared knowledge and collective effort lead to better security practices and more robust software. By making this PoC available, KillaBoi not only demonstrates a specific exploit but also contributes to the broader educational landscape of vulnerability research and mitigation.
Key points
- The PoC demonstrates a remote code execution vulnerability in PHP 8.4.26.
- It exploits memory exhaustion during session upload-progress parsing to leave stale state.
- The exploit chain involves leaking heap and PHP code addresses.
- A forged PHP structure is then used to call `zif_system` for arbitrary command execution.
- The PoC is a single-file Python script designed to reproduce a "Steal My Bitcoin CTF" solution.
The public release of this detailed PoC can significantly aid security researchers and PHP developers in understanding and patching this specific vulnerability, leading to more robust and secure web applications. It provides a clear blueprint for identifying similar memory handling issues, fostering proactive security measures within the open-source community.
The detailed nature of this PoC, while educational, could also be misused by malicious actors to exploit unpatched PHP installations, potentially leading to widespread compromises of web servers. The complexity of the exploit, relying on specific PHP versions and build configurations, might make it challenging for some administrators to accurately assess their risk and apply necessary mitigations.