Comment by janalsncm
11 hours ago
Every reason you just gave for not hacking this server is also true for servers which don’t have a $500 prize, which is almost all of them out there.
11 hours ago
Every reason you just gave for not hacking this server is also true for servers which don’t have a $500 prize, which is almost all of them out there.
This is a server that allegedly has some BTC on it (AFAICT it’s just a claim made by the website itself, zero corroborating evidence), definitely nothing else valuable, and likely has a lot of monitoring to capture whatever exploit you send, and with a less-vulnerable-than-usual setup. Unless you’re really desperate for the money and want to take a gamble on the server having the not very meaningful bounty it says it has, it’s strictly negative value compared to the average production php server that’s still unpatched. If I have a working exploit I’m mass deploying against everyone, I too would skip this one, similar to how mass market malware tends to disarm itself when it detects security research tooling.
No, I don’t think actual working exploit is trivial either, but people are wayyyy overselling this stunt in this thread.
The average PHP server that is unpatched now will remain unpatched after OP publishes the exploits because that server’s admin is clearly not scouring the web for security vulnerabilities.
Also, an increasing number of admins of PHP servers probably are no longer alive, so they will not be applying security patches.