This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.
Seems like everyone here has an exploit but they're all busy washing their hair, or thinking of the children, or making huge amounts selling their exploit on the darknet instead.
Given there are public patches and explanations of the issue, isn't it a little late to try to keep this under wraps?
Over a day or two we'll see whether people have an exploit - if more than a few people do, someone will claim this soon.
There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.
If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful
Because only a fraction of people would double check (AI or otherwise), AI making it easier to flood the zone with fine tuned spam actuallu has the opposite effect. We're seeing this at play at a large scale anywhere an election is happening right now. The narratives are even less truthful than before.
The server is getting overloaded, so here's the text for reference:
Steal my Bitcoin
0.65 hours without a successful hack
There is a bitcoin key hidden on this server worth about $502.
It is accessible to the PHP user account through the print-flag binary.
This PHP version was selected from before the PHP2SHELL CVEs were released.
First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
Challenge wallet
Explorer ↗
bc1qlnu5…t3cxqy
0.00625104 BTC
≈ $502.35 USD
stealmybitcoin.com · Terms of participation
Great way to inject some price information into the “AI automates exploits at scale” narrative. “AI can now chain complex exploits, it’s point-and-click pwnage, you say? Over or under $500 a pop?”
I'm seeing a few comments that say $500 isn't enough, and its not worth it for them to try to hack it.
But if it costs fewer than $500 of tokens in an AI, then it seems like it is? I thought a lot of the claim people are making is that you dont actually need to hack anything you just ask an AI and it does it. The exploitable bug is public and documented. All the pieces are theoretically there, and there are repeated claims that AI is trivializing exploits and its super easy to hack things now.
If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.
It’s not very much information, I agree. Even such scant information, however, is a significant and refreshing improvement on the current state of the narrative. Kudos to the servermaster, I say.
For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol
These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.
Regardless, I'm guessing the smart hackers aren't going to bother.
This will go unclaimed for a bit. It may still get claimed within the day, but
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.
The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…
The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.
Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.
Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.
You seem to imply there's some economic reason such a white-hat hacker wouldn't take the $500 but don't actually say what it is.
You, the white-hat hacker would be concerned that your attack exploits payload will be logged either by the potentially malicious site operator who could be using this to gather various working exploits, or by other bad actors who already exploited the site before you. Unless your exploit itself is already well known and fully public that is.
If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.
I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here
> a fundamental misunderstanding of the economics at play
I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?
I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?
> I, and many of my friends and cooks could take this easily.
What an insufferable comment. For all the hullabaloo discussing the economic value of time about $500 being an insufficient prize, you still spent what I can only assume is several minutes penning a comment that derives you zero economic value whatever.
A pentesting YouTuber I once respected went deep into the AI rabbit hole and claimed yesterday he created a generic POC using ChatGPT in 2 hours to show how dangerous LLMs are [0]. After that he shilled his AI pentesting platform.
If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.
Suddenly all the people who claim that these PHP exploits are so easy that a baby could do it are clamming up at the opportunity to showcase it. Plenty of "I/We can do this easily, but uh.. we uhh.. don't want to right now bye" going on.
> A reminder that this cannot falsify the existence of an exploit, trivial or otherwise.
No, it's a not a zero knowledge proof. But if the site owner is a generally trustworthy person, then I feel that this effort is strong proof the exploit is not trivial.
Sure. Also, we have to trust owner of the site. So it cannot show anything, strictly speaking.
Still, it maybe puts a price on exploit demo. Some say "it goes around twitter", "bots are probing and exploiting it", "it's a biggest thing ever in cybersec history, invest in AI now". Some say "it's a fud".
Are these 500$ laying on a ground for anyone to take?
If you want to contribute to something and get rewarded, https://nonograph.com has paid out over $30,000 this year for feature and bug fixes. (check the github)
Well usually you have a PHP application actually doing something, not just serving static files. If it's just static files, PHP2Shell isn't really a thing.
Imagine 1000 people torch $100 in tokens before giving up on getting the $500 prize. Let’s go on to assume one person gets a lucky reasoning trace that nails it, then posts a blog about how they made $500 with $100.
You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.
Shouldn’t the expected value of attempting this somehow include the likelihood of the key actually being on the machine? Surely the probability is much higher than 0? I would guess the expected value for actually being the first one is around $300, not 0
You may need to brush up on your game theory. It's worth it to spend $1 for a 1% chance to win a million dollars. You don't need to be certain the key is there for it to be worth it to do a supposedly trivial exploit.
Your giving away the exploit though so it's not really only $1. How much is having it actually worth, probably more then that, probably more than $500 too.
The exploit is supposedly so trivial that everyone needed to take down their services until they could patch? There should be nothing to give away here, which I think is the point. Either it’s trivial and you swipe the $500 or it’s not and you save it (assuming you have it). In the latter case you shouldn’t really be worried, since they won’t burn an exploit on you either.
It is a price signal. They expect to lose the money they want to show that nobody has an automated swarm just pwning every server running PHP connected to the internet. At least not yet, on day 5 and counting.
Given there are public patches and explanations of the issue, isn't it a little late to try to keep this under wraps?
Over a day or two we'll see whether people have an exploit - if more than a few people do, someone will claim this soon.
It clearly isnt happening.
If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
That's pennies for something like this.
Add two zeros and it might get nabbed.
https://www.youtube.com/watch?v=52LJaWDdG9c
If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.
For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol
These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.
Regardless, I'm guessing the smart hackers aren't going to bother.
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
Make it $15-25k and it’ll get yoinked instantly.
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.
The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…
The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.
Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.
I think what he's saying is if you had that, you certainly wouldn't use it on a known honeypot for 500 bucks.
Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.
You seem to imply there's some economic reason such a white-hat hacker wouldn't take the $500 but don't actually say what it is.
Sure you can.
I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?
I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?
> I, and many of my friends and cooks could take this easily.
Extreme doubt.
It is just kind of fun to poke at something like this.
> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).
> The difference is we know not to.
Borrrrinnnggggg
If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.
[0] https://youtu.be/SP7y1h0laN0?si=ZhJcn-VDpB1cm0Wv
No, it's a not a zero knowledge proof. But if the site owner is a generally trustworthy person, then I feel that this effort is strong proof the exploit is not trivial.
It can only show you if someone has used an exploit against this server.
Are these 500$ laying on a ground for anyone to take?
If it gets swept you are breached.
thank me later
But if they were not, and had ill intentions, they might see $500 as a very inexpensive way to purchase a working exploit to use against others.