Also, unless I am reading this wrong, it does not seem like what actually got the bitcoin was a 2shell-like exploit? Seems like memory corruption leading to printing out the flag through just http requests? How would you use this outside of a CTF context?
KillaBoi/StealMyBitcoin-PoC
> A1 — Memory Exhaustion (~383MB):
I'm actually somewhat surprised at the clumsiness here.
I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it.
DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests.
Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.
> it's not that easy to exploit.
With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.
The related public challenge (KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.
More details about stealmybitcoin in LiveOverflow's video: youtube.com
This is the winner: KillaBoi/StealMyBitcoin-PoC
The challenge website was not exploitable at launch because it wasn't actually running PHP; it got cracked in two hours aftewards
In the video, LiveOverflow shows his exploit that reliably gets RCE from two requests.
php2shellを利用したCTF(BitCoin wallet)のサイトと、成功者のWrite-up stealmybitcoin.com "KillaBoi/StealMyBitcoin-PoC: A public release of the Steal My Bitcoin challenge" KillaBoi/StealMyBitcoin-PoC
1 like
@troed why should i watch a crappy video ?
I prefer reading the code which illustrates the so called "exploit"
KillaBoi/StealMyBitcoin-PoC
So you need to tell the attached the php version and the PID in order to allow it to break you ?
In what world is that an "exploit" ?
1 like
Stealmybitcoin poc + 3 more repos · hot in AI Oct 26, 2026 #Shorts
killaboi/stealmybitcoin-poc: killaboi/stealmybitcoin-poc
Every link from today, plus the free daily email: hotin.ai
REPOS
▸ amywork777/lipflow
A dictation app types silently mouthed words at the cursor while a key is held.
amywork777/lipflow
▸ morganlinton/beautifulrust
Agent skills teach coding agents to write, review and port idiomatic Rust.
morganlinton/BeautifulRust
▸ rddmwmddr/android-ad-cleaner
An Android cleanup tool disables system ads, trending searches, recommendations and promotional notifications without root access.
rddmwmddr/android-ad-cleaner
▸ killaboi/stealmybitcoin-poc
A proof-of-concept repository publicly releases the Steal My Bitcoin challenge.
killaboi/stealmybitcoin-poc
Source: hotin.ai daily 2026-10-26 (Oct 26, 2026 · 7:26 AM PT), sha256 055d82840d643423570e15a7ba350b47a4171b0da739384e7dfb0f2132f0ec55
#Shorts
4 views
There was a steal my bitcoin challenge which offered some bitcoin if the PHP instance could be compromised. It was won after 19.28 hours.
The solution exploit has been posted, which I've confirmed to work.
From the exploit:
> The offsets and multipart […]
[Original post on infosec.exchange]
1 like · 2 reposts
The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.
github.com/KillaBoi/StealMyBitcoin-PoC/tree/main
22 favourites · 1 comment · 24 boosts
The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.
11 likes · 3 reposts
Mentions
Also, unless I am reading this wrong, it does not seem like what actually got the bitcoin was a 2shell-like exploit? Seems like memory corruption leading to printing out the flag through just http requests? How would you use this outside of a CTF context? KillaBoi/StealMyBitcoin-PoC
> A1 — Memory Exhaustion (~383MB): I'm actually somewhat surprised at the clumsiness here. I'm a complete amateur that had DeepSeek build a PHP2Shell exploit, and once the stealmybitcoin site went up and set an upload limit, i had DeepSeek try to shrink/amplify it. DeepSeek couldn't find anything but a 2x reduction, but reading the report of how it was done - KillaBoi/StealMyBitcoin-PoC - I was somewhat surprised it didn't find it, and equally horrified at PHP allowing such a memory bomb of creating nested objects by parsing `f[0][x][x]...` from random requests. Point being; these aren't amateurs but i kind of expect most well funded pros to have found this method to avoid sending massive filenames and session progress data.
> it's not that easy to exploit. With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters. The related public challenge (KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.
More details about stealmybitcoin in LiveOverflow's video: youtube.com This is the winner: KillaBoi/StealMyBitcoin-PoC The challenge website was not exploitable at launch because it wasn't actually running PHP; it got cracked in two hours aftewards In the video, LiveOverflow shows his exploit that reliably gets RCE from two requests.
php2shellを利用したCTF(BitCoin wallet)のサイトと、成功者のWrite-up stealmybitcoin.com "KillaBoi/StealMyBitcoin-PoC: A public release of the Steal My Bitcoin challenge" KillaBoi/StealMyBitcoin-PoC
@troed why should i watch a crappy video ? I prefer reading the code which illustrates the so called "exploit" KillaBoi/StealMyBitcoin-PoC So you need to tell the attached the php version and the PID in order to allow it to break you ? In what world is that an "exploit" ?
Stealmybitcoin poc + 3 more repos · hot in AI Oct 26, 2026 #Shorts killaboi/stealmybitcoin-poc: killaboi/stealmybitcoin-poc Every link from today, plus the free daily email: hotin.ai REPOS ▸ amywork777/lipflow A dictation app types silently mouthed words at the cursor while a key is held. amywork777/lipflow ▸ morganlinton/beautifulrust Agent skills teach coding agents to write, review and port idiomatic Rust. morganlinton/BeautifulRust ▸ rddmwmddr/android-ad-cleaner An Android cleanup tool disables system ads, trending searches, recommendations and promotional notifications without root access. rddmwmddr/android-ad-cleaner ▸ killaboi/stealmybitcoin-poc A proof-of-concept repository publicly releases the Steal My Bitcoin challenge. killaboi/stealmybitcoin-poc Source: hotin.ai daily 2026-10-26 (Oct 26, 2026 · 7:26 AM PT), sha256 055d82840d643423570e15a7ba350b47a4171b0da739384e7dfb0f2132f0ec55 #Shorts
There was a steal my bitcoin challenge which offered some bitcoin if the PHP instance could be compromised. It was won after 19.28 hours. The solution exploit has been posted, which I've confirmed to work. From the exploit: > The offsets and multipart […] [Original post on infosec.exchange]
The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment. github.com/KillaBoi/StealMyBitcoin-PoC/tree/main
The winner of the stealmybitcoin[.]com exploit challenge has a remarkably good writeup on the #PHP2Shell exploit process. The PoC clearly explains what's involved in targeting and calibration for any given PHP version/deployment.