● Covered by 1 source · 1 reportMedium impact1 neutral
Proof-of-Concept Released for Steal My Bitcoin CTF PHP Vulnerability
Key points
- Python PoC for Steal My Bitcoin CTF exploit released.
- Exploit uses PHP memory exhaustion to leak heap and code addresses.
- Forged PHP structures enable remote code execution via `zif_system`.
- Vulnerability affects PHP 8.4.26 CLI server behind nginx.
Exploit Reproduction Script
A single-file Python script, `stealmybitcoin_poc.py`, has been released to reproduce the exploit sequence used in the Steal My Bitcoin CTF challenge. The script uses only Python's standard library to build and execute HTTP requests, verifying each information leak before proceeding to the next stage of the exploit.
Vulnerability Mechanism
The exploit leverages a memory exhaustion issue in PHP when processing small multipart uploads. When PHP runs out of memory during session upload-progress parsing, it leaves stale state in the worker process. Subsequent requests can then extract sensitive information, such as heap addresses and PHP code addresses, through session cookies.
Remote Code Execution
With both the heap and code addresses obtained, the script sends a final request that drops a forged PHP structure. This structure is designed to be found by PHP's cleanup routines, which then call `zif_system`, PHP's handler for the `system` command. This allows for arbitrary command execution on the server, demonstrated by sending back a proof marker and a `print-flag` result.
Target Environment
The proof-of-concept was developed and tested against a Docker lab environment running an Alpine PHP 8.4.26 CLI server behind nginx. This setup matches the build and worker model for which the exploit's memory offsets were calibrated. The exploit chain is designed to run end-to-end on a local machine.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub cmc_internal/api GitHub github/collect GitHub KillaBoi/StealMyBitcoin-PoC GitHub _private/browser GitHub get-started/accessibility GitHub open-source/sponsorsReporting from
A Python script has been released that reproduces the exploit chain for the Steal My Bitcoin Capture The Flag (CTF) challenge. The script demonstrates how memory exhaustion in PHP can lead to information leaks and remote code execution, highlighting a vulnerability in PHP's handling of multipart uploads and session management.