- Published on
Steal My Bitcoin CTF PoC
- Authors
- Name
- DeepHorus
A new proof-of-concept (PoC) for the "Steal My Bitcoin" CTF challenge has been released, demonstrating a full PHP exploit chain using only Python's standard library. The single-file script reproduces heap and code leaks, then achieves remote code execution via a forged HashTable. It provides a reproducible method for security researchers to study the vulnerability.
The challenge involves a PHP application vulnerable to memory exhaustion through multipart uploads. Small uploads cause PHP to consume excessive memory, leading to out-of-memory conditions during session upload-progress parsing. This leaves stale state in worker processes, which can be exploited.
The PoC targets PHP 8.4.26 on Alpine Linux with four workers, matching the Docker lab environment. It requires three files: a health endpoint, a print-flag script, and an nginx configuration. The entire chain runs locally, with the live run kept as a historical note.
The exploit uses a 249,042-byte producer and eight 6,672-byte requests to trigger OOM, leaking a 256-byte cookie with the Zend chunk base. A second leak of 16 bytes reveals the address of zval_ptr_dtor. Finally, a 368,812-byte POST with a forged HashTable executes zif_system.
This PoC impacts security researchers and CTF participants by providing a detailed, reproducible exploit. It highlights risks in PHP session handling and memory management, particularly in applications using similar worker models. The technique could be adapted to other versions, but build-specific offsets are critical.
The security community has shown interest, with some noting the PoC's complexity. The author acknowledges the code is "ugly" and could be cleaned up, referencing a previous video. Despite this, the PoC serves as a valuable educational tool. Some have suggested simplifying the code, but the author maintains it is a work in progress.
Looking ahead, the author plans to refine the PoC and possibly release a cleaner version. Future work may explore automating offset discovery for different PHP builds, making the exploit more portable. The technique could also inspire new CTF challenges. The author encourages others to build upon this work.
This release fits into a growing trend of CTF challenges simulating real-world vulnerabilities, emphasizing memory safety and proper session handling. It underscores the value of reproducible exploits for education and vulnerability research. Defenders can better understand and mitigate such attacks.
