logoalt Hacker News

Show HN: Steal My Bitcoin

484 points • by cloudlandsdev • yesterday at 8:30 PM • 299 comments • view on HN

Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!


Comments

qbane • yesterday at 9:38 PM

I remembered that there was a similar challenge for Heartbleed.

earthpyy • yesterday at 9:07 PM

Interesting idea! Would like to know how much time need to spend.

monskov • yesterday at 10:18 PM

bounty seems to have just doubled, 1000 usd now

jsphweid • yesterday at 10:16 PM

Looks like someone just added ~$500 more to it?

v3ai • yesterday at 9:50 PM

major pain in the neck that anthropic doesn't let opus 5.5 work on this, goes back to 4.8 lame

➕ show 3 replies
cromka • yesterday at 11:27 PM

Keep your hands off my Bacon!

Izmaki • yesterday at 9:52 PM

This has to be the cheapest way to obtain a working POC. Lol!

➕ show 1 reply
qwertytyyuu • yesterday at 10:20 PM

oooh, is this what they call a ctf?

brcmthrowaway • today at 12:13 AM

Whats going on with PHP? Is there a twitter drama?

qwertytyyuu • yesterday at 10:20 PM

ooh is this what they call a ctf?

aussieguy1234 • yesterday at 10:57 PM

This could be a trap.

Someone does the exploit, then the creator of this service logs it and uses that exploit to go after higher value targets...

hsuduebc2 • yesterday at 10:51 PM

I wonder how many times the value of the credits on this challenge would exceed the potential reward here.

j45 • yesterday at 10:36 PM

In viral form, its now $1000?

sashank_1509 • yesterday at 9:00 PM

You have to be really confident that the PHP RCE is not anything serious, 500$ is quite a bit?

➕ show 4 replies
rvba • yesterday at 9:32 PM

this should be done on one of those barebone servers that run on an 8bit commodore or an atari (self identifying as something else)

medellin • today at 12:48 AM

Thank you for showing what we all know. The security community is full of fear mongering prima donnas. I always hated security but now they are becoming insufferable. “Omg myleethax break the web” everyone freak out!!!!! Omgggggg. Absolute fing children.

ingen0s • yesterday at 10:12 PM

Honeypot lol

cluckindan • yesterday at 11:51 PM

If the flag isn’t captured by opening bell on monday, the bubble will burst.

hsuduebc2 • yesterday at 10:25 PM

Price has doubled I see. Interesting idea lol

bogomind • today at 7:22 AM

[flagged]

bogomind • yesterday at 11:27 PM

[flagged]

aftbit • today at 3:36 AM

[flagged]

pwython • today at 1:25 AM

[flagged]

hackernud3s • yesterday at 11:51 PM

[flagged]

i_have_an_idea • today at 12:33 AM

[flagged]

EXnn • yesterday at 9:01 PM

[dead]

SadErn • yesterday at 10:15 PM

[dead]

tamimio • yesterday at 9:26 PM

$500 isn’t worth the time, make it at least $5k then we talk.

➕ show 1 reply