Steal My Bitcoin

You can get $500 in Bitcoin by exploiting a known PHP vulnerability.

A challenge is underway where a Bitcoin key, valued at approximately $500, is hidden on a server and accessible via the PHP user account through a print-flag binary. The server is running a version of PHP released before the PHP2SHELL CVEs, indicating a deliberate use of known vulnerabilities. The first individual to successfully retrieve the Bitcoin wallet will win its contents. The organizers have stated that all traffic is logged and that privacy cannot be guaranteed due to the machine's known vulnerabilities, advising participants against submitting any sensitive information. An explorer link for the challenge wallet and the terms of participation are provided on the challenge website.

This challenge highlights the ongoing relevance of exploiting specific, dated software vulnerabilities for financial gain. It demonstrates that even with extensive logging and warnings, a sufficiently motivated individual can still find value by identifying and leveraging unpatched or intentionally vulnerable systems. The choice of an older PHP version before specific CVEs suggests a testing ground for exploit detection or a gamified capture-the-flag scenario aimed at security practitioners.

The event underscores the persistent gap between widespread awareness of known security flaws and their actual remediation in diverse environments. Participants are incentivized to actively seek out and apply exploit knowledge, potentially discovering new methods or simply practicing existing ones in a live, albeit controlled, scenario. This type of challenge can serve as a barometer for the ease with which legacy vulnerabilities can still be weaponized.