davikr · 116 points · 24 comments · vor 10 Stunden · Open original
Comments
5 preview comments · loading full thread
Log in to use comments
Log in to h4cker, then connect Hacker News to publish comments.
NONorwegianDudevor 7 Stunden
To be fair, the person who created the challenge stated that is was a fairly standard setup, replicating something outside a lab, but in reality is was something completely different, and not anywhere near how PHP is usually used.
It used the development server in PHP, and did not even run requests with fpm or mod_php. Instead, it used the built in dev server of PHP, and just proxied requests from nginx to the php dev server.
Literally the first thing on top of the PHP docs about the dev server used here is this:
"Warning
This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network."
That is not something people do, and it also explains why the site was down all the time, cause the dev server is super slow, as it's not meant for this in any way shape or form. A real setup would add a few zeros to the requests per second a server could handle.
So all in all, this was very pointless, as it was nothing like real php sites. A shame, cause a realistic setup woild be more interesting and relevant to answer the question of how hard is it really to gain RCE on a normal site.
BUbushwartvor 5 Stunden
Related: https://x.com/JamesPavur/status/2114501212313653696
Apparently the wallet key wasn't on the server, like some in the original thread suspected, but perhaps not due to maliciousness after all.
ZEzerataxvor 3 Stunden
between the challenge being updated to actually run php and this only like 2-3 hours passed
GNgnabgibvor 9 Stunden
This is already linked by it's author in the Steal My Bitcoin thread (585 points, 458 comments) https://news.ycombinator.com/item?id=50224916
FIfishgoesblubvor 7 Stunden
As an outsider this was fun to watch. Namely, the dozens of l33t haxors including so-called "professionals" who claimed they'd be able to solve this in a jiffy with their magic exploits, yet couldn't.
Comments
5 preview comments · loading full threadLog in to h4cker, then connect Hacker News to publish comments.
To be fair, the person who created the challenge stated that is was a fairly standard setup, replicating something outside a lab, but in reality is was something completely different, and not anywhere near how PHP is usually used. It used the development server in PHP, and did not even run requests with fpm or mod_php. Instead, it used the built in dev server of PHP, and just proxied requests from nginx to the php dev server. Literally the first thing on top of the PHP docs about the dev server used here is this: "Warning This web server is designed to aid application development. It may also be useful for testing purposes or for application demonstrations that are run in controlled environments. It is not intended to be a full-featured web server. It should not be used on a public network." That is not something people do, and it also explains why the site was down all the time, cause the dev server is super slow, as it's not meant for this in any way shape or form. A real setup would add a few zeros to the requests per second a server could handle. So all in all, this was very pointless, as it was nothing like real php sites. A shame, cause a realistic setup woild be more interesting and relevant to answer the question of how hard is it really to gain RCE on a normal site.
Related: https://x.com/JamesPavur/status/2114501212313653696 Apparently the wallet key wasn't on the server, like some in the original thread suspected, but perhaps not due to maliciousness after all.
between the challenge being updated to actually run php and this only like 2-3 hours passed
This is already linked by it's author in the Steal My Bitcoin thread (585 points, 458 comments) https://news.ycombinator.com/item?id=50224916
As an outsider this was fun to watch. Namely, the dozens of l33t haxors including so-called "professionals" who claimed they'd be able to solve this in a jiffy with their magic exploits, yet couldn't.