Hacker bros maybe our larp got exposed and the real cybersecurity knowledge is the friends we made along the wayhttps://stealmybitcoin.com
>>110160172How do you steal something that isn't real
>>110160172i got to it and like >>110161020 said, there was nothing there
>>110160172Could've told us the wallet address so we can check if it's still there.
>>110161707It's there on the site. Points to https://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqy
>steal my _2.5% of a_ bitcoini sleep
>>110160172it's not stealing if you want me to take it
>larpwhat's wrong with live action role playing. stop using it as a pejorative
>>110160172>sell me your weaponized php N-day exploit for $2000hmmm, no, no i don't think i will
>>110160172>just give me a playback of a useful exploit for php2shellNo. There is no proof anything valuable is where he claims.
E-celebs doing damage control in the orange reddit threadITS REAL YOU GUISE PLEASE BELIEVE THE INFOSEC INFLUENCERShttps://news.ycombinator.com/item?id=50224916
>>110162148lmao
>>110162148https://news.ycombinator.com/item?id=50234259Retard
>>110160172THANK YOU to whoever did this!Exposing the cybersecurity scammers.
>>110162193>it wasnt even php>"'"""cybersecurity""'" trannies tried and tried and couldnt figure that out until website owner told themthis makes it even worse
>>110162225>Didn't have it set up>Doesn't have request parsing>Literally best cased setup>Still segfaultingYou're looking more and more like a clown by the hour.
>>110162193>>110162225This doesn't say that its not running php. It just says that the index.html is static.According to OpenAI, Cloudflare and AWS, the exploit doesn't need a vulnerable php script, it only needs php running.
>>110162247Using php to serve static pages is not the same thing you fucking retard.
>>110162240According to OpenAI, Cloudflare and AWS, it doesn't need a php script "request parsing" to exploit it.Don't move the goalposts, cybersecurity scammers.
>>110162257According to OpenAI, Cloudflare and AWS you can hack this server.You do not need any special executed php scripts. The vulnerability is in php itself.
happenxisters...
>>110162247>index.html is static>it only needs php runningkek smooth brain
>>110162193>served from PHP's webserver????
>>110162259>>110162273>wtf what do you mean having php only sendfile() an index.html isn't exploitable?>WOW SCAM CVE MUCH? legitimate brain damage.
>>110162302True though. And all he had to do is allow an arbitrary sized document upload for multipart and call it a day (still would be impossible to exploit but would trigger all the paths the CVE asks about)
>>110162273where's the proof of concept you utter retard?or do you trust le big corporation trying to sell you an anti-sasquatch rock charm?
>>110160172the bulnerability was a scam, so nobody will be able to do that
>>110162302according to php2shell.com, it is indeed vulnerable.That is what we got promised.If you can't hack this, it means it was a scam.
>>110162148https://news.ycombinator.com/item?id=50227671Most intelligent post in this whole thing.
Uhhhhh relaxers???? I think we're fucked...
>>110162349If you read the actual php diff, you'd know how retarded you sound.
>>110162369so you are saying that according to the actual php diff, all the cybersecurity tards lied to us?
>>110162390Anon, you're functionally retarded. Just stop digging this hole.
>>110162356>p-please stop thinking about it!>p-please don't expose us as scammers!
>>110162403i got promised a CVS 10.0, later downgrades to 9.2, and the specifically emphasized that there is no specific vulnerable php script needed.If you say that the people writing CVS and scoring it lied, then argue with them, not with me.
my schizo take, this is a honey pot filled with malicious strings and he's hoping that people point their llms in yolo mode at it so he can steal YOUR BITCOIN
>>110162358They are DDoSing it, because they know it is a scam and don't want it exposed.
>>110162302to cite the very people who found and reported it:>The vulnerable code is in PHP itself. Websites can be affected even when their application code is secure, including a simple "Hello World" application running on an affected PHP version.
Is every web server CVE going to get a media spergout now because... LE AI?
>>110162495I just think it's nitpicky when the CVEs are real actual nothingburgers and even if they gave the full monthy "do what you like everything's enabled and unsecured" nobody would be able to claim anyway.
Why is orange reddit DDoSing the site?
why is there $500 now?
>>110162497Not because of AI. It's just content farming nonsense. People will overhype everything while at the same time retards will underhype it, like the dipshits itt.
>>110162523Do you agree that the authors lied?Do you agree that the twitter demonstration, where they hack a hello world, is a lie?Because that is what you say. That they lied. That php2shell.com is a lie, that the Sam Altman tweet is a lie, that Cloudflare and AWS lied.You agree to all of this, but you try to compromise on a>ok, but there is still a serious vulnerability beneath the liesI dont even know what your point is right now, what does he have to do on his server to make it vulnerable?Suggest something!What needs to be configured on the server for you to be able to hack it, using THIS specifc vulnerability.
>>110162403>stop being right I'm starting to look stupid :(kek
>>110162568What "authors?" https://www.php.net/archive/2026.php#2026-10-21-5Just read this, stupid fucks.
>>110162603>What "authors"?Are we now already memoryholing who praised himself on finding it?>Research and responsible disclosure: Wiz Research — Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz;OpenAI Codex Security — Amy Burnett;Calif — Ryan A.And again:Make a suggestion, tell us what has to be run on a server to make it possible for you to hack it with this vulnerability.What do you need?Say it!
>>110162630I'm not memoryholing anything, I'm just calling you what you are. A retard sensationalizing things you don't understand. I've seen the code, you clearly haven't and making statements and opinions based on nonsense.
>>110162495It relies on the attacker injecting php code into a hash bucket via a bogus POST request that php will then slurp while cleaning up after a critical OOM exception. how do you force a OOM exception with a post request? if you break the attack into two parts the timing, which was already impossibly fine, is lost entirely and the attack fails. There was never a vulnerability there. It's just attention whores trying to get their name on something.
>>110160172>$2000it's $500 now
>>110162568A yes.B I have not seen any such demonstration, but I acknowledge that the demonstrations are a mix of outright fabrication and heavily controlled impossible lab conditions (I have not seen demos of the latter either, just write downs that show a plausible case for this, clearly outlining the conditions required are impossible in the real world).>>ok, but there is still a serious vulnerability beneath the liesIf you had learned to read in preschool you would realize this isn't what I said anywhereYou have brain problems.
>>110162603Tell me what exact nginx and php config you need on what versions and i will deploy it on a server.I am ready and willing to provide you the environment to prove to the whole world that this vulnerability is an actual usable vulnerability.You could be the first person on the whole world to demonstrate to us that it is possible.OpenAI would shower you with money, because currently it is them who look like scammers and who get scrutiny for being liars.
>>110162679Unless the author is rugpulling it sounds like someone did it already >>110162663Also the most exploitable is httpd and mod_php since mod_php has the most favorable exploitable process recycling behavior. Stop being a brain damaged retard and get over yourself. It's honestly insane how pathetic you areAlso read >>110162356
>>110162703No, the wallet has not been captured. It also doesn't matter which mod is most exploitable when the claim is everything is exploitable. Also see >>110162679
cool bounty desu, its interesting to see how people reactall CS fields such as cyber security have always been 80% larping faggots who cant write code, only steal itso it makes sense for virtue fags to crop up. it would be weird if they didnt
>>110162703>most favorableat 0.00000001% chance. see>>110162655how do you force an OOM exception? It's required for the exploit to work so you must know how to force mod_php to use the entirety of available virtual memory, that's physical and swap, in order to cause the exception necessary for the exploit to work. How do you force an OOM exception with a POST request?
>>110162717>I-it hasn't been capturedthe cope.
>>110162703>seems like someone didnope, lol>Also read......the post that says "it doesnt matter whether or not its a scam, pls pls forget about it, lets all just not talk about this anymore"?No, the person who exposes a grifter, isnt the grifter. The grifter is the grifter.Just how it is useless that you argue here with me, when your actual problem is the liars and grifters who claimed stuff that wasn't true (term for it: A lie).If you claim that there is some truth somewhere beneath the lies, it isnt the people who point out that a lie is a lie who are your enemies. The liar is your enemy. The liar is the reason why you dont get taken serious.
>>110162717I like how you keep deflecting like a pathetic brain damaged cuck.
>>110162734>>110162749Why are you crying at axiomatic facts? That's like having a melty over someone saying 1+1=2.
>>110162766>WHAT NGINX PHP SETUP DO I NEED? >NO YOU CANT SUGGEST A PRACTICAL SETUPyou're the one arguing 1 + 1 <> 2.
>>110162773>no argument nor answerBrain problems status: profound
>>110162766Why isn't there a video of it yet? Every new RCE exploit has poseurs rushing to social media to post clips of themselves pulling it off on a local test server and yet the only videos I've seen of php2shell are blurry nonsense littered with unnecessary jumpcuts and random special effects blocking half the screen. Why hasn't anyone made a clear simple video demonstrating it in action? Why put all that editing work into a video in order to hide what's actually going on? Why do half of the videos cut right before the exploit runs even though they're not doing anything illegal or even sketchy?
>>110162837not that anon, but i want you to consider what i'm about to say seriously: what benefit would someone get out of posting a demonstration of the full exploit containing detailed instructions? you can get just as much izzat by posting the edited video on xitter without the risk that a company who gets pwned by some skiddy who ripped your exploit suing you for damageslook at the melty that came just from the people "breaking muh embargo" on it fucking 12 hours early. imagine if they'd included a full working poc?
All the money still therehttps://mempool.space/address/bc1qlnu50y4zm0nwxkckxu09thn5xdcz8aw6t3cxqyIts funny how the infosec tards try to hide the lie with even more lies.>but but actually we never claimed that it is exploitable in a default config!!>actually the money is already taken anyway!!!All those niggers need to get shot.Its all just fucking grifters.
>>110162879you can't sue somebody for demonstrating an exploit on their own local server. that's total utter bullshit and you know it. here's your proof bro lmaohttps://www.youtube.com/watch?v=cE4h79AWbT4
>>110162879>what benefit would someone get out of posting a demonstration of the full exploit containing detailed instructions?2000 USD, lots of fame and possibly a job at OpenAI
>>110162879Most these CVEs never have a public PoC either. Idk why people keep suggesting it is normal.
>>110162903the page cache exploit hadlog4j hadEvery single exploit that is important has.Scam expoloits, that can't be used in any real world scenario, typically dont.This one is a scam.
>>110162920>a handful of them did! Uh, ok. Point?
>>110162899you can sue someone for literally any reason whatsoever. whether you'd win is a separate question entirely, but you're still tied up in court either way. it's the chilling effect of corporate lawfare>>110162902$2000 is literally nothing. it's a slap in the face.as for fame and a job at openai? lol? are you joking? i'm not trying to be rude, but this is incredibly naive. literally dozens of CVE pocs get posted every year. no one gives a fuck. i can link you some really good writeups if you're interested?
>>110162903>niggerfaggot doesn't know how to replicate a PoC from description of CVE and only knows how to run a github scriptget rootkitted, lmao
>>110162940ALL important ones had
>>110162903cybersecurity companies are scammers. they are constantly harassing my supervisor about free assessments. every time somebody at the company bites they immediately send a doom and gloom report straight to the executives declaring every non-exploitable vulnerability as a critical threat and the supervisor gets their ass chewed for even entertaining the retards. then they offer ptaas with continuous automated pentesting to keep our shit secure. anybody with sec101 experience knows you can't automate pentesting and ptaas isn't a real thing. everybody in finance knows they're lying scammers and you should only answer their calls in order to hang up on them.
>>110162944>the reason why nobody can use this exploit in real world is because they just don't want tothe USA could crush Iran, they just don't want to
>>110162995>they're scammers! >says the low IQ retard who's employer is shamed after massive data breach or silently pays a ransom to a random hackerman groupOk.
>>110162998ok, so you're just trolling. got it
>>110162944>$2000 is literally nothing. it's a slap in the face.you claimed your free $5 from X money right?stfu larping retard
>>110162995>be me>disgruntled cybsec engineer>ransomware idiots like you for funyour ego will one day pop like a balloon and it will be funny
>>110163016>>110163025we have our own security department. in the eleven years i've worked there we haven't had a data breach. according to the cybersecurity companies we're wide open for attack and yet it never happens.
>>110163025I dont see any difference between ransomware scammers and cybersecurity scammers.Didn't you just inflict millions on damage by scaring people into shutting down their servers for half a day?What else is this than a social engineering attack?
>>110163109they do jack shit and you know itif they had some real emergency where they had to intervene they would be too slow and ineffective to stop anything>working at single company for longer than 2 yearstells me everything about the company>>110163121one guy breaks the window and the other just threatens to break it
ez, the key is 4.
>>110163109Doesn't mean anything bro. Pretty much every company is running some broken garbage and just waiting to be hacked.
>>110163173>one guy breaks the window and the other just threatens to break itRansomware threatens to break it, if you don't pay them.Cybersecuritytards threaten that someone else will break it, if you don't pay them.The difference is that ransomware is actually honest. They do not lie to you. If you pay them, they decrypt your files and you have nothing to fear.Meanwhile you may pay the cybersecuritytard and still get your window broken. Or you don't pay them and still be fine.
>>110163279>They do not lie to youHAHAHAHAHAAHAHyou had to see the ransomware I did, even if they paid I wouldn't send the decrypt key half the time
>>110163173>they do jack shit and you know itSeems to work for him.Meanwhile Microsoft Azure and Google get hacked regularly, Cloudflare gets .unwraped and 4cuck shuts down for a day because they fell for a social enginnering scam.
>>110163300Then nobody in the world ever encountered your ransomware.Are you an infosec tard and you only deployed it at your customers?
>>110163318I deployed it to few thousand SMB vulnerable NAS backups of small to medium companies>>110163311Better safe than sorry is my motto but eh who asks me
>>110163337So you only deployed it at your customers. Got it.>better safe than sorryIf some indian calls you on your phone and asks you for your ssh keys, because there is some super serious vulnerability and he needs to fix it, will you give it to him?No?What's the difference?Better safe than sorry!btw. this is how 99% of hacks happen. If you tell all your employees to NEVER reply to cybersecurity tards, you are suddenly MASSIVELY more secure.If you care about security, you assume that it is fearmongering per default. That is the responsible thing to do.
>>110163366>my customersyou're a retard, I don't shit where I eat, I am not an animal like you>If some indian calls you on your phone and asks you for your ssh keys, because there is some super serious vulnerability and he needs to fix it, will you give it to him?to my honeypot server I would just so I could see what they are doing to it
>>110163389You said vulnerable SMB NAS.How do you get into the same network as they are in the first place?>Dear Mrs. Becca, there is a SUPER SERIOUS vulnerability on your system and i need you to give me your credentials RIGHT NOW! Greetings, Cybersecurity Office MumbaiA secure company is a company that rejects every single infosec or cybersecurity tard.That is simply a fact. You can't argue against the truth.
>>110163408>How do you get into the same network as they are in the first place?>>he thinks businesses aren't dumb to keep it on public IP because of their ego
>>110163441They indeed aren't, LARPer.Now go ahead and use the current php vulnerability to grab your free 2000 USD.
>>110160172Yet another thread of infosec tards getting BTFO, you love to see it.Imagine shutting your servers down for half a day because you fell for this scam.There will be lots of blood, many infosec tards will lose their job.We will make sure that your bosses know that you lied to them.This is the moment you die. Your whole field exposed as one giant grift.You are low IQ monkeys and should be treated as such.
>>110163485Avatar use
>>110162537It was 500 USD at first.Others then added money to the wallet.The money to grab is actually getting MORE, not less.
cloudlandsdev 7 minutes ago | next [–]Update 4: There's a solve!!!Turns out exporting a well-formed bitcoin wallet key is hard. I put a wallet-branch WIF on the server, rather than the WIF for the funded address inside that wallet.Server logs support this being the first (and indeed only) successful execution of the `print-flag` binary with exfiltration and the person who contacted me definitely knows the value of the WIF key on the server so I'm going to evalute this like a solve. I'm in touch with the person who has the flag now and will transfer the wallet to them shortly.LOOOOOOOLRELAXER CHUDS BTFO & PWNED
what shoulc i hack with php2shell before its gone?
>>110163605You mean a known exploitable memory vuln was actually exploitable? Does this mean I never need to hear about this shit for the rest of the week?
>>110163619Hurricane Electricshe.net
>>110163647SHUT THE FUCK UP, CHUD
>>110163605>Turns out exporting a well-formed bitcoin wallet key is hard. I put a wallet-branch WIF on the server, rather than the WIF for the funded address inside that wallet.this is retarded he made it impossible to hack so he made it easier and boom we have a winrar
>>110163485This post didn't age so well... https://news.ycombinator.com/item?id=50236736You gonna kys for doing all this backpedaling cope?
>>110160172I've got my clanker creating a recon script to determine everything it can about the server and spin up a docker container of a clone of the system so I can attempt some manual attacks while the clanker tries some of its own. Apparently this is an "official" CTF registered somewhere and won't trip ethics guardrails in most agents, so it'll go full black hat mode while I'm trying some more outside of the box attacks because I suspect the person running this thing already hardened it against most of the shit that my agent is going to try first.I know the key is already gone, because there's a pending transaction of all the BTC out of the wallet....i just want to see if I COULD have gotten it had i seen it a few hours sooner
>>110163485very based take i agree
>>110163676>https://news.ycombinator.com/item?id=50236736> i made my server artificially easy to exploit so it could be exploited!!! :)
/g/ stays losing. the exploit is real. its almost as if the national security agency knows more than you fucking subhuman retardstheres a reason why dumbfuck AIs which cant remember shit and cant tell me how many rs in strawberry there are. its because youre fucking stupid.
this board is just a bunch of contrarian faggots
>>110164880who should commit suicideAI has trashed their genius larp, theyre all obsolete midwits
well well well
congrats on hacking a well-known alpine docker image. assessment is still:https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/>Exploit developers are unlikely to create a single universal exploit that works reliably across all affected PHP deployments. The creation of a POC exploit capable of reliable remote exploitation is feasible, however, against specific deployment profiles, such as a fixed Docker image or a known combination of PHP, libc, SAPI, and web application versions. For such cases, an attacker can calibrate exploit offsets and heap grooming in advance, producing an exploit that reliably applies to any system running that same unmodified package or image release.>In the short to long term, advanced threat actors will likely attempt to exploit this vulnerability against high-value targets where alternative exploitation methods are less feasible.
>>110165091cope harder faggotits fucking OVER for fa/g/s, luddites, and techboomersI hope you had fun while it lasted midwit
i still find it funny that this ai-slop challenge forgot to actually use php at first nor ever had the bitcoin key on the server
>>110165091The official docker images are what people use in production, so it is absolutely legit to try those first. They have alpine and debian versions for fpm and apache.
>>110165306>They have alpine and debian versions for fpm and apache.the ai-slop challenge used neither. the image is the fpm tag but the container runs php -S, so the sapi is php's cli-server. https://github.com/pavja2/smbc-source-oct-2026/blob/main/Dockerfile#L12
>>110165405>the container runs php -SYou fucking serious? Holy fucking shit this is lame. I feel like we've been fucked over. This challenge is clickbaitslop. Did they even use the new vulnerability to hack the server?The built in server is for development, not for production use. It probably has a bunch of random vulnerabilities of its own. I'd never expose it to the internet. It's absolutely not representative of prod use.I usually take the fpm image, install the extensions and nginx in it and add the config files. It is not that difficult.
>>110165630>Did they even use the new vulnerability to hack the server?It's documented alreadyhttps://github.com/KillaBoi/StealMyBitcoin-PoC
Turns out the vuln was real and BTC was stolen. Thanks for making this waste of a thread. What a dumb conspiracy. You know you can just make a PoC using AI? Claudes a fucking faggot, but you can design it with grok then have claude write it
OP, once again, proved a massive faggot
>>110165680>larpers be like: yea we did it. no not me, but we, we did it together. i use a thinkpad with a Matrix background so it was a matter of time until one of us made it.
>>110165680https://github.com/killaboi/stealmybitcoin-poc
Lmao where are all the chuds that were insulting us and AI now?
>>110162148>Every time I scale the VPS, y'all immediately blow through the extra computewhat did the indian mean by this? compute? this jeet is talking about bandwidth, isn't he?
>>110163485You could not have picked a lamer thing to be schizophrenic about.
>>110165680AIIIIIIIIEEEEEEE
>>110162135>>110162137So who or what is worth using a PHP zero day on? And if no such valuable targets exist, then the vulnerability wasn't actually a vulnerability because nobody cared to exploit it, and thus why it was never fixed even though it was flagged years ago.
>>110165973I thought that it was funny that there were actual named "security experts" in that thread going "ohhh noooo, we totally have an exploit but we're not going to show it teehee", only for some random jeet to pull it off less than a day later. This is exactly why no one trusts the experts.
>>110160172>My bitcoin was stolen after: 19.28 hourslmao
>>110165652>>110165781Why is the PoC repo sponsored by the eceleb that was commenting in the HN thread?(hover over the logo)
>>110166098The code is there and it works. Whether it's rigged or not is a separate issue, but I highly doubt it was that easy to rig given how many people were going at it and crashing the server to the point where it became a game of luck as to who could pull it off first..
>>110162109that's a lot of blowjobs from where I'm from
>>110162109I could've had a succulent dinner every night at McDonald's for almost a month with that amount of money.
>>110165805Right here, it took 19+ hours and all of hackernews, preddit and 4chan trying non stop to do it.
>>110166098Stop noticing
>>110165805It's indeed great that it works in lab conditions when the config is deliberately fucked so that the exploits becomes possible. It still took 20 hours despite this. How come none of the 22m servers still vulnerable to it completely unharmed though?
>>110162135wasn't it supposed to be so easy to pull off any frontier llm could do it for a few dozen bucks? here's an insta 10x to 1000x for vibegods
>>110165818no, PHP isn't a simple http server with static webpages, that's the whole fucking point illiterate nigger
Lol and lmao
>>110165680autistic retards find a reason to disagree with everything and this board is choke full of them
>>110166676>choke full
guys why is there so much seethe at cybersecurityGAWDs around these parts?maybe you are just mad that someone out there is doing actual and meaningful work that helps others?don't forget your anti-scam training videos btw
>>110162135so you admit the whole "shut your servers down now!!" thing was a tranny LARP
>>110167236how does this have anything to do with transgender people?
>>110167307Everything you retarded corpo faggot
>>110167422nta, but you sound unwell
>>110167307>how does this have anything to do with transgender people?
>>110167657You can clearly tell this guy is living out his sexual fetish his atire and hair and mannrisms are probably copied from some poor college girl he creeped on
>>110166334Thankfully every single site that was vulnerable is worth less than $2k for hackers so all those mitigations and patches were unnecessary. Takes more than 18 hours to compromise is our motto of security.
