KillaBoi/StealMyBitcoin-PoC

选用指南

AI 根据 README 整理 · 2026/11/2 09:31:45

适用场景

适用于复现Steal My Bitcoin CTF挑战的攻击流程，或在Docker实验室环境中测试PHP 8.4.26的漏洞利用。

查看 README 依据

**Everything below is written against the Docker lab**, not the live challenge. The lab is a local Alpine PHP 8.4.26 CLI server behind nginx, which is the same build and worker model the offsets were calibrated on. [Stand it up in a minute](#the-lab) and the whole chain runs end to end on your own machine. The live run that actually solved the challenge is kept as a historical note at the [bottom](#the-live-run-that-solved-it). ``` stage what goes out what comes back ─────────────────────────────────────────────────────────────────────────────

0 health GET /php-version.php -> PHP 8.4.26 confirmed 1 heap leak 249,042 B producer + 8 x 6,672 B -> 256 B cookie (OOM poisons a worker) └─ Zend chunk base 2 code leak 251,557 B producer + 8 x 92,388 B -> 16 B cookie (OOM poisons a worker) └─ zval_ptr_dtor 3 callback 368,812 B POST -> forged HashTable runs (fake HashTable + command) └─ zif_system(cmd)

目标用户

面向CTF玩家和安全研究人员，用于学习和复现PHP内存损坏利用技术。

查看 README 依据

<p align="center"> _{sponsored with ❤️ by}&nbsp;<a href="https://hextree.io" title="he didnt want a dono so i gave him this banner, ty mr liveoverflow for helping"><img src="https://i.ibb.co/fVZ3Nvcx/hextree.jpg" alt="hextree.io" height="22" align="middle"></a> </p> # Steal My Bitcoin CTF proof of concept > One live PHP callback against the Steal My Bitcoin challenge, start to finish, in a single standard-library Python file.  

**Everything below is written against the Docker lab**, not the live challenge. The lab is a local Alpine PHP 8.4.26 CLI server behind nginx, which is the same build and worker model the offsets were calibrated on. [Stand it up in a minute](#the-lab) and the whole chain runs end to end on your own machine. The live run that actually solved the challenge is kept as a historical note at the [bottom](#the-live-run-that-solved-it). ``` stage what goes out what comes back ─────────────────────────────────────────────────────────────────────────────

使用方式

通过命令行运行Python脚本，需指定目标URL，可选输出目录。运行需Python 3.11以上，仅用标准库。

查看 README 依据

A couple of notes on that recipe. The image is the `fpm` tag but the container runs `php -S`, so the SAPI is `cli-server`, which is what the calibration was measured against. `PHP_CLI_SERVER_WORKERS=4` is what gives the leak stages more than one worker to race for. My own lab harness also passed `--cap-add SYS_PTRACE --security-opt seccomp=unconfined` so it could attach a tracer to the workers; the PoC itself never does that, so those are left out above. --- ## Start here Python 3.11 or newer, standard library only, nothing to install: ```powershell

python .\stealmybitcoin_poc.py --url http://127.0.0.1:18166/php-version.php ``` Run it with no arguments and it prints its help and exits without touching the network. A good run looks like this: ```console [health] PHP 8.4.26 confirmed [heap] strict Zend base 0x78113e800000 [code] strict zval_ptr_dtor 0x615b1f512930 {"stage": "final", "nonce": "1ef0e73d8615157a", "execution_proof_verified": true, "response_path": "..."} ```

部署要求

需要Python 3.11及以上，且目标环境需为Alpine PHP 8.4.26 CLI服务器（四worker），Docker镜像为php:8.4.26-fpm-alpine3.23。

查看 README 依据

A couple of notes on that recipe. The image is the `fpm` tag but the container runs `php -S`, so the SAPI is `cli-server`, which is what the calibration was measured against. `PHP_CLI_SERVER_WORKERS=4` is what gives the leak stages more than one worker to race for. My own lab harness also passed `--cap-add SYS_PTRACE --security-opt seccomp=unconfined` so it could attach a tracer to the workers; the PoC itself never does that, so those are left out above. --- ## Start here Python 3.11 or newer, standard library only, nothing to install: ```powershell

The offsets in this PoC are calibrated for **Alpine PHP 8.4.26 running the built-in CLI server with four workers**. The lab reproduces exactly that, behind nginx, on loopback. > [!IMPORTANT] > The build matters more than the version string. A Debian `php:8.4.26-fpm` stack reports the same `PHP/8.4.26` but has a different binary layout, so the code-pointer fingerprint will never match and the run aborts at the code-leak stage. Use the Alpine image below. Three small files. Put them in an empty directory: **`public/php-version.php`** (the health endpoint, and the only page the PoC needs)

已知限制

仅适用于Alpine PHP 8.4.26，其他PHP构建可能因地址偏移不匹配而失败；攻击成功率约70%，单次运行可能不成功，需多次尝试。

查看 README 依据

The offsets in this PoC are calibrated for **Alpine PHP 8.4.26 running the built-in CLI server with four workers**. The lab reproduces exactly that, behind nginx, on loopback. > [!IMPORTANT] > The build matters more than the version string. A Debian `php:8.4.26-fpm` stack reports the same `PHP/8.4.26` but has a different binary layout, so the code-pointer fingerprint will never match and the run aborts at the code-leak stage. Use the Alpine image below. Three small files. Put them in an empty directory: **`public/php-version.php`** (the health endpoint, and the only page the PoC needs)

The script makes no claim about whether a returned WIF controls the advertised Bitcoin address. A checksum-valid WIF only tells you the string encodes a private key properly. Deriving the address and comparing it is a separate job. --- ## How often it actually works Both leak stages are races against three other workers, so a single run is not expected to succeed every time. Ten consecutive runs against the lab described above, with no retries and nothing else talking to the container: | Result | Count | | --- | --- | | `execution_proof_verified: true` | 7 |