x.comthreadZex Alpha (@kryptozex) on X
Post about the "Steal My Bitcoin" bounty, a 0.025 BTC (about $2,025) prize that was swept early Monday, about 90 minutes after researcher @killa published a full exploit on GitHub. The exploit is a heap exploit written for the target's PHP build. It leaks memory addresses through session cookies and forces PHP cleanup to run the flag binary. The first solve looked like a failure because the pulled key did not control the advertised address, a planting mistake the creator admitted by email.
TL;DR Reports that a researcher's PHP heap exploit, using session-cookie address leaks and cleanup-triggered execution, won the Steal My Bitcoin bounty.
Organisations named here
- @killa
- KillaBoi
- Steal My Bitcoin
Technologies named here
- GitHub repository KillaBoi
- PHP
- Bitcoin
- GitHub
Techniques named here
- Memory address leak through session cookies
- Forcing PHP cleanup to run the flag binary
Related in Offensive Security
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
github.comrepoYesWeHack Claude Kit
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
huntress.comwriteup