KillaBoi/StealMyBitcoin-PoC

Maintainer? Show your league in your README

Card: your league's emblem, from Copper to Legendary

[![bestofgithub](https://bestofgithub.dev/badge/KillaBoi/StealMyBitcoin-PoC.svg?style=card)](https://bestofgithub.dev/repo/KillaBoi/StealMyBitcoin-PoC)

Flat: fits beside your other badges

[![bestofgithub](https://bestofgithub.dev/badge/KillaBoi/StealMyBitcoin-PoC.svg)](https://bestofgithub.dev/repo/KillaBoi/StealMyBitcoin-PoC)

Loading README…

Flag	What it does
`--url`	Lab endpoint, or the challenge. Required to do anything.
`--output-dir`	Where to write the run's evidence. Defaults to `poc-run-<UTC timestamp>`.

Step	What goes out, what should come back	Why
Health	One ordinary `GET /php-version.php` must return HTTP 200, `PHP 8.4.26`, and `X-Powered-By: PHP/8.4.26`.	Keeps the memory-limit payload away from a changed or unhealthy endpoint.
Heap leak	One 249,042-byte multipart producer, then eight pipelined 6,672-byte consumers. The producer must return a PHP 128 MiB memory-limit fatal. A consumer may return a 256-byte `PHPSESSID` cookie.	Four or more pointer-looking values in that cookie have to agree on one aligned 2 MiB Zend heap base.
Code leak	One 251,557-byte producer, then eight pipelined 92,388-byte consumers. A consumer may return a 16-byte `PHPSESSID` cookie.	Its first eight bytes must encode `16`, and its second eight must look like the locally calibrated `zval_ptr_dtor` pointer.
Final callback	One 368,812-byte multipart POST.	A forged PHP `HashTable` points cleanup at `zif_system` and supplies a command argument. The fresh nonce, `id` output, and `print-flag` binary hash are the evidence that the callback actually ran.

File	Contents
`heap.request.http`, `code.request.http`	The plaintext HTTP bytes handed to each leak-stage socket's `sendall`, one producer plus eight pipelined consumers. If the transport fails you cannot be sure what actually got delivered.
`heap.response.http`, `code.response.http`	Plaintext HTTP bytes read back off each leak-stage socket, cookies included.
`heap.json`, `code.json`	Parsed response status, lengths, hashes, and candidate addresses.
`final.request.http`	The final request as constructed, headers and multipart body. Same caveat about transport failures.
`final.response.http`, `final.response.body`, `final.response.headers.json`	The final response as read, plus its parsed body and headers. Against the live challenge this body may contain a private WIF.
`final.json`, `run.json`	Summary fields, and whether the expected execution markers showed up.

Result	Count
`execution_proof_verified: true`	7
Reached the callback, markers absent	2
Heap leak never landed	1

Term	Meaning
Zend heap	PHP's memory area for request values and internal structures.
Worker	One PHP process handling requests. The stale state and the later consumer need the same reused process, and pipelining does not guarantee you get it.
`PHPSESSID` cookie	Where the unintended memory bytes turn up during the leak stages.
`zval_ptr_dtor`	A PHP internal function pointer, used here to anchor the code-image address calculation.
`zif_system`	PHP's internal handler for `system`, used as the forged cleanup callback.
WIF	Wallet Import Format, an encoding of a Bitcoin private key. A valid checksum says nothing about who owns a particular wallet address.

KillaBoi/StealMyBitcoin-PoC

Steal My Bitcoin CTF proof of concept

The short version

Contents

The lab

Start here

What each request does

1. How a small producer reaches the memory limit

2. How the heap address is recovered

3. How the PHP code address is recovered

4. How the final request reaches `system`

Reading the result

How often it actually works

The live run that solved it

Jargon, briefly

Reading the code instead

Thanks

Steal My Bitcoin CTF proof of concept

The short version

Contents

The lab

Start here

What each request does

1. How a small producer reaches the memory limit

2. How the heap address is recovered

3. How the PHP code address is recovered

4. How the final request reaches system

Reading the result

How often it actually works

The live run that solved it

Jargon, briefly

Reading the code instead

Thanks

4. How the final request reaches `system`