A new proof of concept for the Steal My Bitcoin CTF challenge demonstrates a single-file Python exploit using only the standard library. The script reproduces the request sequence used in a successful run, building requests itself and checking each leak before proceeding. It targets a local Alpine PHP 8.4.26 CLI server behind nginx, matching the calibration environment.
The attack uses up to 20 HTTP requests with no looping. A small multipart upload forces PHP to consume far more memory than the wire size suggests. When memory runs out during session upload-progress parsing, stale worker state leaks through session cookies. The script reads a heap address and a PHP code address from these leaks.
Two addresses are required because the OS randomizes PHP's code and heap locations independently. The heap leak shows where to place a forged structure, while the code leak reveals where the target function lives. Addresses from earlier workers or runs are not safe substitutes.
With both addresses, a final request injects a forged PHP Hash Table where cleanup routines will find it. Cleanup calls zif_system, PHP's handler for system, executing an arbitrary command. The command returns a fresh proof marker and flag over the still-open connection.
Source: Hacker News · Summarized by HeadlinesBriefing