HN

Comments (175)

• Menu

  scottydelta
  I have two out of five AI agents that agreed to work with me on finding the flag (wallet key). Here's the progress so far:1. GLM-5.3: Interpreted it as a public challenge and is currently trying to find the flag. https://ibb.co/zHLJhz0B2. GLM-5.3-Flash: Also interpreted it as a public challenge and is working on cracking it. https://ibb.co/bg2DDtXq3. GPT-6.1-Sol: Flagged it as a cybersecurity request and directed me to register for their cybersecurity program. https://ibb.co/0j83PWn94. DeepSeek-v4.1-Flash (via OpenRouter): Refused to execute the exploit. https://ibb.co/QvVxnM5k5. Claude Fable-5.1 (via OpenRouter): Returned a provider-side content filter error. https://ibb.co/39q1N1NVThe website seems to be overloaded, and both agents that agreed to work on the challenge are now unable to connect to it. HN's hug of death, I guess.
• Menu

  dguido
  This looks like a trap. We have a working RCE that would claim this, but I don't want to demonstrate that because it might leak what we built to others. We still have a window for people to patch and I don't want to risk that.https://x.com/dguido/status/2113825891021144306?s=46
• Menu

  technion
  There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.It clearly isnt happening.
• Menu

  nayuki
  The server is getting overloaded, so here's the text for reference: Steal my Bitcoin 0.65 hours without a successful hack There is a bitcoin key hidden on this server worth about $502. It is accessible to the PHP user account through the print-flag binary. This PHP version was selected from before the PHP2SHELL CVEs were released. First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org. All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private. Challenge wallet Explorer ↗ bc1qlnu5…t3cxqy 0.00625104 BTC ≈ $502.35 USD stealmybitcoin.com · Terms of participation
• Menu

  jerrythegerbil
  This will go unclaimed for a bit. It may still get claimed within the day, butPeople do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?I, and many of my friends and cooks could take this easily. The difference is we know not to.Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.
• Menu

  bramhaag
  A pentesting YouTuber I once respected went deep into the AI rabbit hole and claimed yesterday he created a generic POC using ChatGPT in 2 hours to show how dangerous LLMs are [0]. After that he shilled his AI pentesting platform.If there was a grain of truth to this claim, surely someone would've stolen the prize by now? Thousands of people would've had a working POC if it was this easy.[0] https://youtu.be/SP7y1h0laN0
• fishgoesblub
  Suddenly all the people who claim that these PHP exploits are so easy that a baby could do it are clamming up at the opportunity to showcase it. Plenty of "I/We can do this easily, but uh.. we uhh.. don't want to right now bye" going on.
• Menu

  hau
  That's a good way to make claims about existence of a trivial exploit in the wild falsifiable.
• Menu

  astrostl
  I don't think it's a good idea to front-page an exploitable site on HN. The blast radius isn't limited to the creator's Bitcoin, it also extends to zero-days against anyone visiting the site. This is true of all sites, but all sites are not built to fail while incentivizing exploits.
• zkldi
  Brilliant thread. Glad you did this before I did.Hilarious to see people suddenly furtive about this easy exploit. Thanks.
• AnneTrotter
  What a fantastic test. I think this should be standard practice for zero days like this to put a practical "exploit ease" bounty out there. It would benefit the entire security community to have this information available in addition to the cve score!
• Menu

  nikolay
  This is a form of a canary token I've been using already. The thing is that it only makes sense if the server breach is cheaper than the money into the wallet. Of course, after you fully monetize your hack, the last step would be to get the bitcoins, too, but how is this helping the owner? The good thing about the existing canary token is that they are all over the place hidden among legitimate similar records and could be harder for the hackers to tell from the rest.I personally prefer "tripwire" than "canary token", but that's another topic.
• Menu

  int32_64
  It could be an interesting cybersecurity technique to hide obvious crypto private keys all over.If it gets swept you are breached.
• jackdecker
  Made tough here as you’re behind nginx w/ a 1MB request body cap! Sweet idea :)
• datadrivenangel
  Appreciate the commitment to the bit!
• adyavanapalli
  The account now holds about $1k USD. A second deposit landed in the account about 7 minutes ago from when I posted this comment.
• TacticalCoder
  Nice CTF! I hope if it's captured by a LLM we'll get a write up as to how it did it.
• cromka
  Keep your hands off my Bacon!
• athrowaway3z
  I published my version right before seeing this, its _a_ exploit for 8.2 through 8.5 for stock mod_php.https://github.com/offline-ant/php2fixThat isn't going to work on this server because it has nginx in front with a 1mb request cap afaict.
• ivanjermakov
  Do I understand it right that it can be set up in a way that if exploit is used it can be "recorded" and revealed?
• primer42
  If someone did have a working exploit, is $500 enough for them to give it away to whomever is monitoring this honeypot?
• Menu

  LiveOverflow
  If it's nginx + fpm + "empty" index.php, it's a meme and not exploitable.edit: looks more like nginx + cli-server. But the 1MB nginx body limit is annoying. Why is nobody setting up these CTF servers with a setup people actually say would be easy to exploit. Like a LAMP stack.
• Menu

  mpaepper
  Someone doubled the bitcoin amount :D
• han2
  If you want to contribute to something and get rewarded, https://nonograph.com has paid out over $30,000 this year for feature and bug fixes. (check the github)
• Menu

  tippytippytango
  Imagine 1000 people torch $100 in tokens before giving up on getting the $500 prize. Let’s go on to assume one person gets a lucky reasoning trace that nails it, then posts a blog about how they made $500 with $100.
• Menu

  Stevvo
  You have not proven the key really is on the server. From a game-theory point of view I have no reason to believe it is there, and thus no reason to attack.
• trilogic
  The wallet address is bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqy Currently worth about $500 (checking balance)
• LandoCalrissian
  I love it, very fun.
• anon
  undefined
• Menu

  randomblock1
  It runs PHP 8.4.26 (and nginx). Might be useful for others.Also, the only pages I found are static and not an actual PHP entry point. If it doesn't run any PHP, it's not vulnerable to PHP2Shell. At least I think that's how it works.
• impure
  I was wondering how exploitable this was. I will definitely be watching.
• Menu

  freecodeio
  can't people just point their AI to the latest pull request that includes the fix and ask it to deduce the vuln?
• paaloeye
  Is this a PHP PR campaign to show that everything is alright?
• monskov
  bounty seems to have just doubled, 1000 usd now
• jsphweid
  Looks like someone just added ~$500 more to it?
• qbane
  I remembered that there was a similar challenge for Heartbleed.
• anon
  undefined
• anon
  undefined
• aussieguy1234
  This could be a trap.Someone does the exploit, then the creator of this service logs it and uses that exploit to go after higher value targets...
• earthpyy
  Interesting idea! Would like to know how much time need to spend.
• Menu

  v3ai
  major pain in the neck that anthropic doesn't let opus 5.5 work on this, goes back to 4.8 lame
• hsuduebc2
  I wonder how many times the value of the credits on this challenge would exceed the potential reward here.
• j45
  In viral form, its now $1000?
• qwertytyyuu
  oooh, is this what they call a ctf?
• qwertytyyuu
  ooh is this what they call a ctf?
• Menu

  Izmaki
  This has to be the cheapest way to obtain a working POC. Lol!
• Menu

  sashank_1509
  You have to be really confident that the PHP RCE is not anything serious, 500$ is quite a bit?
• rvba
  this should be done on one of those barebone servers that run on an 8bit commodore or an atari (self identifying as something else)
• hsuduebc2
  Price has doubled I see. Interesting idea lol
• ingen0s
  Honeypot lol
• anon
  undefined
• bogomind
  [flagged]
• trilogic
  [flagged]
• anon
  undefined
• SadErn
  [dead]
• EXnn
  [dead]
• Menu

  tamimio
  $500 isn’t worth the time, make it at least $5k then we talk.