⬢github Python · 866 ★ +721 since we first saw it · pushed 17 h ago
KillaBoi/StealMyBitcoin-PoC
A public release of the Steal My Bitcoin challenge
A single-file Python proof-of-concept that reproduces the exploit used to solve the 'Steal My Bitcoin' CTF challenge. It abuses PHP 8.4.26 memory-exhaustion during session upload-progress parsing to leak heap and code addresses via session cookies, then triggers remote code execution by forging a PHP HashTable so cleanup calls zif_system. It runs against a local Docker lab (Alpine PHP + nginx) using only the standard library.
Why now: A public release of the PoC behind a recent CTF solve, discussed on Hacker News and tied to a video walkthrough, drawing attention for demonstrating a full PHP exploit chain in ~20 HTTP requests.
Who it is for: Security researchers, CTF players, and PHP internals enthusiasts who want to study or improve the exploit.
Stars over our 106 snapshots: 145 to 866, since 1 d ago.
Where people talked about it
- Yhn Steal My Bitcoin CTF PoC 3 min ago
- ⬢github new repos, most starred 14 min ago
API: https://socialmediatrends-api.osmike.com/v1/repos/KillaBoi/StealMyBitcoin-PoC