NorwegianDude3 hours ago
To be fair, the person who created the challenge stated that is was a fairly standard setup, replicating something outside a lab, but in reality is was something completely different, and not anywhere near how PHP is usually used.
It used the development server in PHP, and did not even run requests with fpm or mod_php. Instead, it used the built in dev server of PHP, and just proxied requests from nginx to the php dev server.
Literally the first thing on top of the PHP docs about the dev server used here is this: "Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."
That is not something people do, and it also explains why the site was down all the time, cause the dev server is super slow, as it's not meant for this in any way shape or form. A real setup would add a few zeros to the requests per second a server could handle.
So all in all, this was very pointless, as it was nothing like real php sites. A shame, cause a realistic setup woild be more interesting and relevant to answer the question of how hard is it really to gain RCE on a normal site.
weird-eye-issuean hour ago
That's interesting because there were people complaining yesterday that this was a fully static website with no PHP involved lol
nodja9 minutes ago
unsnap_biceps36 minutes ago
[dead]
decidu0us903415 minutes ago
HITCON CTF has a realistic php2shell challenge. Think it has ended up with 0 solves so far, not sure.
tonymet2 hours ago
are you saying this lead to dos (and less competition)? or easier penetration?
At first glance, this wouldn't affect demonstration of the vuln.
gnabgib5 hours ago
This is already linked by it's author in the Steal My Bitcoin thread (585 points, 458 comments) https://news.ycombinator.com/item?id=50224916
bushwart2 hours ago
Related: https://x.com/JamesPavur/status/2114501212313653696
Apparently the wallet key wasn't on the server, like some in the original thread suspected, but perhaps not due to maliciousness after all.
fishgoesblub3 hours ago
As an outsider this was fun to watch. Namely, the dozens of l33t haxors including so-called "professionals" who claimed they'd be able to solve this in a jiffy with their magic exploits, yet couldn't.
stackghost2 hours ago
The only professional I saw making that claim was the CEO of trailofbits who is a former NSA TAO member and doesn’t have anything to prove by talking a big game.
It wasn’t that difficult of an exploit, to be honest. I myself am not the leetest of the leet but I was most of the way there, having been set back by the downtime and my time zone. It’s definitely a fiddly, tricky exploit as most memory exploits are but I think the initial alarm was justified.
While waiting for the server to come back up, it took me about 3 hours with LLM assistance to write a php2shell RCE for nginx and mediawiki on the same version of php as TFA.
The biggest win, as others have also observe, was the demonstration that there aren’t swarms of automated pwnbots out there that will insta-root your server.
Considering the amount of downtime, I think that flag got got pretty quickly.
FergusArgyll3 hours ago
This was good wholesome fun! Some foundation should do this for future cve's