The $2,000 PHP2SHELL Challenge Was Initially Unexploitable, Then Solved After a Fix
· 14:33 · Watch on YouTube ↗
Summary
LiveOverflow explains that the $2,000 PHP2SHELL challenge was initially unexploitable because it lacked a PHP script, then became exploitable after one was added. The video details the solve, exploit construction, and limitations of the unusual server setup.
Key points
- James Pavur’s Bitcoin challenge began with a $500 wallet that grew to $2,000 through donations.
- The challenge initially served an index.html file without the PHP script needed to reach the vulnerability, so the early period without a successful exploit was not a fair test.
- About 17 hours after launch, the author added a PHP script. Twitter user @killa reportedly solved the challenge roughly two hours later.
- The presenter describes the setup as nginx with the PHP CLI server and contrasts it with PHP-FPM setups, where application behavior such as calling session_start can affect exploitability.
- The exploit uses out-of-memory triggers and a use-after-free to leak an address, then achieve code execution; the presenter describes reducing the stages to two requests each.
- The challenge server blocked outgoing requests, preventing a callback-based test; the presenter instead retrieved command output in the HTTP response.
- In traffic testing, an exploit using 32 requests failed on its first attempt and succeeded on its second. The presenter notes the setup is atypical and says benchmarks will follow separately.
Article Details
- Topics
- [00:00] The Bitcoin challenge, PHP2SHELL, and the initial claim that the exploit was difficult to use in real conditions
- [02:19] Assessing the server configuration, PHP-FPM requirements, and the challenge’s initially missing PHP script
- [06:00] The challenge fix and the reported timeline for @killa’s successful exploit
- [07:58] Agent-assisted development of address-leak and code-execution stages, including binary identification
- [10:04] Last-byte synchronization and coordinating requests to improve exploit timing
- [11:52] Blocked outbound callbacks, returning output over HTTP, and traffic testing against the atypical PHP CLI setup
MITRE ATT&CK
People
@killaThe Twitter user reported to have successfully exploited the challenge after it became exploitable.Andreas RianchoCredited by the presenter as having initially shared the last-byte synchronization technique discussed for coordinating requests.James KettleThe presenter said he learned about the last-byte synchronization technique from him.James PavurSet up the Bitcoin challenge and confirmed that it initially contained only an index.html file; he later added a PHP script.Mohan SiriusWorked on the challenge and reportedly achieved a successful address leak on the live site.