Update 4: There's a solve!!! Congrats to @killa (https://x.com/killa) who actually posted the last 3 characters of the private key in this very thread a few hours ago.
Turns out exporting a well-formed bitcoin wallet key is hard. I put a wallet-branch WIF on the server, rather than the WIF for the funded address inside that wallet.
Server logs support this being the first (and indeed only) successful execution of the `print-flag` binary with exfiltration and the person who contacted me definitely knows the value of the WIF key on the server so I'm going to evalute this like a solve. I'm in touch with the person who has the flag now and will transfer the wallet to them shortly.
Transfer made. Next steps will be an operator writeup - thanks for keeping this weekend exciting everyone. Since I now own the stealmybitcoin.com domain (can't believe it wasn't taken), I'm sure some new challenge will end up there eventually ;)
Nice. Assuming all of this is real, do we get a write-up?
Was it actually php2shell, and/or some other exploit?
Going by the fact the setup was rather hostile to exploitation, for the longest time not even exploitable, and under heavy load, I think we can conclude the threat is very real. Again, assuming it's not funny games.
yeah assuming no funny games the threat is real and the primary thing this CTF did while it was misconfigured and on the front page was convince people that the threat was not real. that is probably not an ideal outcome.
similarly to the guy from Trail of Bits talking about how it looked like a trap - apparently this PoC was not impossible for someone else to figure out, the window was not as long as you'd hope (again assuming no funny business), and the "trust me bro this exploit is real" messaging just kind of kills overall credibility and does more harm than good. As does a misconfigured CTF, potentially. People do not have a positive view of tech and especially AI right now and if there's a real threat then fueling the "it's just hype to boost stock price for IPO" narrative is maybe a bigger issue than the vulnerability itself no? Because you also tank your ability to get people to take any future vuln seriously.
Plus a broken CTF is apparently a good way to get people to not take a current vuln seriously while also working as a honeypot to get PoCs. Probably everyone involved with good intentions should make sure they're really thinking through all the implications (preferably ahead of time so there's a playbook). Meaning societal/psychological/narrative implications too and not just technical. Security of all fields should be deeply familiar with how human behavior is kind of critical, no? How many people reuse passwords? The AI industry is uniquely incompetent at this aspect. Like all the datacenter stuff where they make secret deals for tax breaks and cheap land with city councils under NDA and then are suprised that constituents react badly to being taken for a ride by an industry and elected officials they already don't trust. Like just from an optics perspective, charging for daybreak or similar frontier cyber-capable AI to defend from AI discovered/led vulnerabilities and attacks - y'all get how this looks like a protection racket right?
The worst outcome here is AI cyberwar/CVE-apocalypse hitting while the industry is treated as the boy who cried wolf even when there actually were previously wolves because everyone involved just sucks at comms and doesn't think things through and now has no credibility to organize a response.
You are right. At work today (Monday) I was literally like you see that person that put bitcoin on a PHP server and it wasn't hacked... oh wait it did get hacked.
Well done. It’s important to know the difference between a real world exploitable bug and hot air; as an open source maintainer, over half of the bug reports I get are “hot air” bugs.
awww my kimi says the thingy they made wouldn't work and would take a lot of effort to fix... sadsad. still, i never even thought of finding the container and binary of the server. very cool of you. (╥ ᴗ ╥)
again, i'm not sure if they actually succeeded (because the server is down and i don't really trust their local tests), but they seem to have done that.
awhh i didn't win... anyway, can you try to make the website work so i can see if kimi and deepseek ever managed to do something? kimi claims it found a full tested aslr disclosure thingy, so it might work?
yaya but i wanna check now. i'm curious if kimi and deepseek ever got anything actually going or just bullshitted me for 10 hours straight, and it won't feel as cathartic to see that they had actually succeeded if i check tomorrow.
i'm poor, i can't donate :(
(i also shouldn't have used $140~ in API credits, but that's a whole different issue (don't bully me for my... bad spending habits ( • ᴖ • ｡)))
Update: Did not expect the amount of traffic! Every time I scale the VPS, y'all immediately blow through the extra compute. Should be up again, hopefully will be more stable once this drops off the front page.
Any attempt at logging so I can make a blog about the successful solve is gonna be best effort, don't have disk capacity to keep up with the traffic (at peak it was rotating every 12 min...). If you win the challenge, write-ups are definitely welcome.
For those who are saying that the nginx config is unfairly difficult, intention was just to replicate a fairly normal config that was more realistic than you'd get in a lab environment. If we get to 24 hr+ with no solves I'll see about making it easier. In the meantime, seems like you can perhaps mitigate PHP2Shell with the right nginx config, so that's pretty neat!
I believe it's not exploitable. People say that it's obviously easy when you know the exact config. So can you proof it's even possible? I am pretty outspoken about php2shell being realistic to exploit, so I am happy to independently verify to everybody that it is a realistic setup. You can reach me @LiveOverflow on Twitter or so.
OP confirmed that the server was initially serving only an index.html. In that configuration, the vulnerable code path is never reached — it requires a .php file.
OP added php-version.php roughly 18–19 hours into the experiment (I'm not sure of the exact timing), so that period should be subtracted from the publicly displayed challenge duration.
Based on my external fingerprinting, I now believe the setup should actually be exploitable!
However, the server is being absolutely hammered with requests and crashes. Making it significantly harder to pull off. This is imo still an unrealistic target. If you are not taking the top 1% PHP websites, then they will have long periods (1 minute) of no traffic.
If someone manages to pull off a working exploit under these conditions, that would be crazy to me.
Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page. From the traffic, it seems plausible that some people have an theoretical exploit path through PHP's HTML server itself, without relying on PHP functions, but no one has pulled it off quite yet.
Wait what? You're saying you believe php2shell is "realistic to exploit" but that the site owner has to be the one to do the exploit to prove to you that you're correct?
Where did the OP confirm that? All I saw was OP satisfying the haters by putting a page that explicitly uses PHP. However, people were reporting seg faults on PHP prior. Can't do that if PHP isn't accessible right?
What is the normal config? Could you publish the setup on GitHub or anything like that? I see some say that it is hardened, others saying it doesn't run PHP etc.
Would be fun to see what it's actually running. :)
This was presented as a normal setup of PHP, but in reality was something completely different. Nobody runs PHP like this. This used the dev server in PHP and proxied requests from nginx to the php http dev server. Literally the first thing in the php docs about the dev server is:
"Warning
This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."
It's also singel threaded and very slow, so that explains why the site was so damn unusable.
It's a shame, as a realistic setup would be much more informative.
Nothing turned off and no special hardening over a default php setup within the container, some hardening on the host machine to reduce the risk of some zero day against the OS scuttling the competition. Added a /ping endpoint to validate.
If you can get the php process to run the `print-flag` binary you will get the flag.
It would be nice to see what terms would be if not claimed, specifically, if not claimed in X days (how about 28 since there could be little claim of protecting an exploit at that point) will the money go to the charity you mention?
I ask because I think that would incentive a few more people bumping the bounty.
Will give it some thought. I have some initial reservations about staking any claim on what happens to the money / don't want to solicit donations. From my perspective, the goal was to leave $500 on a street corner with a sign saying "Take Me!" and see how long it lasts. If someone puts their own money on the same street corner that's on them. But if the pot ever got really big and I couldn't maintain the site for whatever reason, some sort of plan is probably worth having.
Update 2: Someone is definitely popping a segfault; still no RCE yet but I think it explains some of the instability people are experiencing. Will set the php server to restart after extended outages instead of configuring FPM or something that changes the surface area of the challenge.
Can't _prove_ that the server is running PHP, but I added a `/php-version.php` page to help calm the conspiracists. Still no changes to the default nginx configuration since it seems we've got a few people getting close with those segfaults, but aware people think it'd be easier if I made those.
kimi claims it has a working sub-1 MiB RCE chain locally. alas, it can't exploit your website due to pesky pesky ASLR. in the words of kimi: "I need either the ZendMM or libc base plus a calibrated delta". would you be so kind as to give them, or disable ASLR?
edit: don't worry folks, kimi says a subagent "found a credible path to a real pointer leak". everything's under control and kimi will exploit the website in T-(?) minutes.
While you are at it, could you also enable ssh on port 22 and slip in my keys for user root? It's what I use in my test setup and my RCE POC relies on it.
Also everyone working on an exploit to claim the reward has the interest to keep others from getting there first, so there is a strong incentive to keep the server unusable.
Aaand it is down again, and I have never seen it alive.
The experiment looks like "Steal my compute/storage scaling money and uptime", and it barely matters that there is some Bitcoin behind it: a company could lose more than $2000 if agents constantly break its website.
I'm making one as a hobby project alongside my day job.
It's a debate chat game where two humans debate on a topic and a biased AI judge picks a winner. Over time players compete for ELO rankings like in chess or similar head-to-head competitive games.
I'll probably make a blog post someday about what's been involved but I think the points in OP are spot on. I've been struggling to make the format feel fun and lively. Two things really helped compared to my early versions - real-time streaming of the other person's arguments so you're not just staring at a timer while they're writing and very very short rounds so you get feedback and results quickly.
The costs are a bit high but not terrible for a hobby project that no one really plays. My unit cost is around $0.008 per game if an NPC is involved and around $0.004 if it's between two humans. I could probably cover that with really intrusive ads but I'm hoping to get enough users paying for cosmetics (speech bubbles, profile pictures, etc.) to help subsidize the rest of the platform.
I've also tried a version with AI NPC opponents and it's much less fun than playing against real humans for reasons I can't entirely articulate. The AIs just don't make for very interesting debaters and the wins against them feel a bit shallow somehow. Right now, I've got NPCs on the game which you can opt into debating if you spend more than 30 seconds in the matchmaking queue but I hope once I get proper player counts I can disable them entirely.
I'm super biased, but proud of how the game has been coming along. Will make a show hn post someday but if anyone's curious my alpha version is live here: https://letsarg.com
Turns out exporting a well-formed bitcoin wallet key is hard. I put a wallet-branch WIF on the server, rather than the WIF for the funded address inside that wallet.
Server logs support this being the first (and indeed only) successful execution of the `print-flag` binary with exfiltration and the person who contacted me definitely knows the value of the WIF key on the server so I'm going to evalute this like a solve. I'm in touch with the person who has the flag now and will transfer the wallet to them shortly.
Transfer made. Next steps will be an operator writeup - thanks for keeping this weekend exciting everyone. Since I now own the stealmybitcoin.com domain (can't believe it wasn't taken), I'm sure some new challenge will end up there eventually ;)
Update 4.5: Challenge source (mostly courtesy of Codex...) posted here: https://github.com/pavja2/smbc-source-oct-2026
reply