Comment by jerf
7 hours ago
"There was also that other guy who posted "steal my bitcoin" on a vulnerable PHP server with the private keys to prove it was overblown, and got his bitcoin stolen within a day."
19 hours: https://stealmybitcoin.com/
Part of the confusion is that the initial PR for the release made it sound like there was a ready-to-go exploit that was just push button, get shell on any PHP server in the world. That turned out not to be the case, as evidenced by the fact that the number was 19 hours and not 19 minutes.
But the fact that it was 19 hours and not "never" also does provide a data point that everything that was vulnerable really was vulnerable, it just may not have been quite as vulnerable as it was initially presented. Still plenty vulnerable, of course.
My point here being that the initial 24 hours were very confusing and I think it's worth remembering that and giving people grace for it. Even now, I've heard rumors of an exploit that does work on all boxes without making changes for a specific target but I'm not actually sure whether that exists or not. (Any further info welcome.)
It's not 19hours. The server was originally configured with no running php. Once they added a php file, the server got pwned in 2 hours.
Interesting. I did not know that. (Obviously.)
This exploit depends on the deployment. With PHP-FPM, an OOM during request startup terminates the child, so the corrupted state wouldn’t survive for subsequent requests to exploit. The challenge used PHP’s built-in server, where the worker was reused.
Doesn't mean that there isn't another exploit chain that can be used though. Challenge also had 4 workers total, so pining one worker wasn't that hard.
In online communities right now there’s a lot of demand for evidence of LLM capabilities being overblown. It’s unfortunate that even if the steal my bitcoin creator apologizes for spreading misinformation due to incompetence, the truth won’t be spread as widely.
Shutting down half the internet was the right move. If it took someone 19 hours to exploit a site, you'd better have shut it down before 19 hours and not after.
I don't see what was confusing about the initial 24 hours. GP was correct, the description of the bug made it clear it was a very high risk.
Also, unless I am reading this wrong, it does not seem like what actually got the bitcoin was a 2shell-like exploit? Seems like memory corruption leading to printing out the flag through just http requests? How would you use this outside of a CTF context?
https://github.com/KillaBoi/StealMyBitcoin-PoC
2shell is catchy shorthand for "do anything". log4shell (originator of the name?) didn't directly give you a shell either, it ran some Java code. You could have a shell if you wanted to.