GoKawiilSecurity researcher publishes Python PoC for PHP memory-exhaustion exploit chain
A developer released stealmybitcoin_poc.py, a standard-library Python script that reproduces the request sequence used to solve the 'Steal My Bitcoin' CTF challenge against PHP 8.4.26. The exploit abuses memory exhaustion during multipart session upload-progress parsing to leak heap and code addresses, then forges a HashTable to trigger a system() call via fewer than 20 HTTP requests. The author notes the script targets a local Docker lab replicating the challenge's Alpine/nginx/PHP-FPM setup rather than the live competition target.
GoKawiil's interpretation of the reporting above, not reported fact.
Publishing a working, self-contained PoC lowers the barrier for others to study or adapt this PHP memory-corruption technique, which could inform both defensive hardening and further offensive research. The author's own framing as an 'ugly' PoC inviting cleanup suggests the release is meant as a teaching artifact rather than a polished exploit tool, which could shape how widely it gets reused or improved by the security community.
- PoC exploits PHP 8.4.26 memory exhaustion during multipart upload-progress parsing to leak addresses.
- Full chain completes in 20 or fewer HTTP requests with no retries, ending in a forged HashTable triggering system().
- Script is built for a local Docker lab replica rather than the original live CTF target.
YubiKey 5C NFC Security Key — If you're diving into CTF challenges and bitcoin security research like this one, it's worth hardening your own accounts with hardware-backed authentication. The YubiKey 5C NFC gives you phishing-resistant two-factor protection for exchanges, email, and dev accounts that could otherwise be targeted by the kind of exploit chains you're studying.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: github.com, 2026-10-26
Published there as: “Steal My Bitcoin CTF PoC”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.