Show HN: Steal My Bitcoin

Category: security

Tags: exploit, php, ctf, memory-corruption, python

Score: 5.8/10 (Innovation: 6, Technical: 8, Documentation: 7, Utility: 2)

This is a proof-of-concept exploit for a PHP 8.4.26 CTF challenge that chains an out-of-memory heap leak, a code pointer leak, and a forged Zend HashTable to achieve remote code execution via `zif_system`. The writeup is unusually detailed about the lab setup, byte budgets, and the reasoning behind each stage of the exploit, making it a strong technical reference even though the utility is limited to security training and CTF work.

Target audience: security researchers and CTF players

Repository: https://stealmybitcoin.com/ · Python · 820 stars

View on Hacker News