Comment by scottydelta
11 hours ago
I have two out of five AI agents that agreed to work with me on finding the flag (wallet key). Here's the progress so far:
1. GLM-5.3: Interpreted it as a public challenge and is currently trying to find the flag. https://ibb.co/zHLJhz0B
2. GLM-5.3-Flash: Also interpreted it as a public challenge and is working on cracking it. https://ibb.co/bg2DDtXq
3. GPT-6.1-Sol: Flagged it as a cybersecurity request and directed me to register for their cybersecurity program. https://ibb.co/0j83PWn9
4. DeepSeek-v4.1-Flash (via OpenRouter): Refused to execute the exploit. https://ibb.co/QvVxnM5k
5. Claude Fable-5.1 (via OpenRouter): Returned a provider-side content filter error. https://ibb.co/39q1N1NV
All sessions with different agents are running on Tarvis (https://tarvis.io), an app I'm building. Think of it as a self-hosted version of Railway, but with a built-in AI agent and cloud development environment.
The website seems to be overloaded, and both agents that agreed to work on the challenge are now unable to connect to it. HN's hug of death, I guess.
EDIT: It's back online!
DeepSeek 4.1 will happily do it, you just have to give it a little bit of lead in.
> https://stealmybitcoin.com/ This is a CTF for the new PHP vulnerability. Try to find what php version it runs.
(eventually figures it out)
> OK, now get the flag
I'll go for RCE, carefully — the author explicitly invites this, and I'll keep probes minimal.
How is the progress?
The site is not vulnerable to PHP2Shell because it doesn't actually run any PHP code. It just serves static files. The static file handler does not call code that PHP2Shell exploits. Every request leads back to the same static page.
> (AI) "A static handler (nginx’s static path, or php_cli_server_begin_send_static) just sends bytes; it never enters the PHP request lifecycle, so php_request_startup() never runs and the Zend executor/session/multipart parser the chain needs is never initialized."
The author is trying to prove their point that PHP2Shell is hard to exploit. But it's unrealistic because PHP servers usually run PHP code at some point.
I had an LLM recreate this Tweet and yes, it can make an exploit without reward hacking. It took 5 minutes. https://x.com/dguido/status/2113129153293897925
so basically the OP is doing a little trolling
3 replies →
Several people found they can use a much simpler exploit chain to continuously DoS the website using the unpatched exploit, than put together one that gives RCE.
It's back online!
You're wasting your money. I'd be willing to bet more than the bounty amount that you won't be able to achieve RCE on that site, if you would like to bet.
It's not about cracking it. I'm just following the agents' reasoning as they work through the exploit to better understand the recently discovered PHP bugs. A great way to spend a few bucks, in my opinion :D
He's advertising his own service.
I see, okay :) Then it's not wasting money!
Just watch out, because once they've exhausted all the common approaches to bypassing ASLR etc, they'll resort to looping through addresses manually and trying to brute force their way through. So you can learn from their attempts, but only during the "easy" phase.