This will go unclaimed for a bit. It may still get claimed within the day, but
People do have the exploit. The risked opportunity cost of this being a honeypot (and handing over a functional exploit) vs just… not participating and hacking higher value targets (offensive actors) or not circulating any additional details (defensive actors who have privileged intelligence about the vulns) I just…
The value proposition here is so hilariously low for what is required to demonstrate stealing the bitcoin at all.
That doesn’t mean that people won’t try, and perhaps even succeed! But to what end? Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I, and many of my friends and cooks could take this easily. The difference is we know not to.
Make it $15-25k and it’ll get yoinked instantly, most likely without using PHP2Shell at all.
>and handing over a functional exploit
There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.
So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
> The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.
Exactly. This server is exploitable, but not with an off-the-shelf PHP2Shell PoC someone found on GitHub. The PHP2Shell exploit would need adjustment to the specific application configuration, and to that end, you’ve come to the same conclusion I was implying.
The easiest way is to use PHP2Shell _with_ another unknown vulnerability in the stack, such as nginx etc…
The challenge is trivial to those who know better than to even try. You cannot succeed at it without giving away far more than you could ever possibly hope to gain.
Of course, there’s always the wildcard of someone throwing away the nginx 0-day just to be funny.
> there's no "one exploit pwns all"
I think what he's saying is if you had that, you certainly wouldn't use it on a known honeypot for 500 bucks.
Correct me if I'm wrong but isn't every PHP RCE... 2 shell?
80h ago everyone was advising everyone else to take all their websites immediately down.
Now it's only worth it to hack a website that's asking to be hacked if the prize is $15k.
Very well said. This is one of the most unintentionally hilarious posts I’ve ever read on HN.
80h ago we had no info other than a vague post from the php page saying a massive security flaw will be announced tomorrow. And a post from a PHP core dev saying shut it all down.
Everyone with inside info was sounding the alarm so the rest of us had to take it incredibly seriously.
If the actual price tag behind the “AI can trivially automate exploits, be afraid” narrative is more like $15,000 and not like $150, that puts the narrative in a very different light.
Can you spell out the economics for us?
Let's assume I am a white-hat hacker with access to this allegedly widespread exploit. Obviously, I understand why a nation-state attacker wouldn't want to share their exploit here but what do I as a random citizen stand to lose? It's not like I care about hoarding the exploit to pwn innocent civilians.
You seem to imply there's some economic reason such a white-hat hacker wouldn't take the $500 but don't actually say what it is.
You, the white-hat hacker would be concerned that your attack exploits payload will be logged either by the potentially malicious site operator who could be using this to gather various working exploits, or by other bad actors who already exploited the site before you. Unless your exploit itself is already well known and fully public that is.
Your exploit payload for a patched vulnerability?
PHP runs something like 75% of major websites. It's unlikely they have all been patched.
Every reason you just gave for not hacking this server is also true for servers which don’t have a $500 prize, which is almost all of them out there.
This is a server that allegedly has some BTC on it (AFAICT it’s just a claim made by the website itself, zero corroborating evidence), definitely nothing else valuable, and likely has a lot of monitoring to capture whatever exploit you send, and with a less-vulnerable-than-usual setup. Unless you’re really desperate for the money and want to take a gamble on the server having the not very meaningful bounty it says it has, it’s strictly negative value compared to the average production php server that’s still unpatched. If I have a working exploit I’m mass deploying against everyone, I too would skip this one, similar to how mass market malware tends to disarm itself when it detects security research tooling.
No, I don’t think actual working exploit is trivial either, but people are wayyyy overselling this stunt in this thread.
The average PHP server that is unpatched now will remain unpatched after OP publishes the exploits because that server’s admin is clearly not scouring the web for security vulnerabilities.
Also, an increasing number of admins of PHP servers probably are no longer alive, so they will not be applying security patches.
> I, and many of my friends and cooks could take this easily.
Sure you can.
These grapes are exceptionally low hanging and perfectly not sour, but I will not deign to pick them even though I could obviously.
Two economists walk past $500 lying on the ground. “I know nobody leaves hundred dollar bills lying on the ground, but that really did look like five hundreds bucks back there, should we go back for it?” Says the first. The second replies “I don’t turn around for less than $15,000.”
I suspect this is going to be more a point about the fact that most PHP server configurations do not have the ability to be exploited by the recent vulnerability that made people think the AI vulnpocalypse was here
> a fundamental misunderstanding of the economics at play
I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?
What an insufferable comment. For all the hullabaloo discussing the economic value of time about $500 being an insufficient prize, you still spent what I can only assume is several minutes penning a comment that derives you zero economic value whatever.
> handing over a functional exploit
I thought the exploit was trivial and we all need to be extremely worried and take down our php services until a patch? So what exactly are you handing over?
> I, and many of my friends and cooks could take this easily.
Extreme doubt.
> But to what end?
It is just kind of fun to poke at something like this.
> Demonstrating terrible math skills and a fundamental misunderstanding of the economics at play?
I don't give a shit about the $500, nor would I ever attempt actually hacking something that wasn't explicitly a game (like this).
> The difference is we know not to.
Borrrrinnnggggg
> I, and many of my friends and cooks could take this easily.
No, you couldn't.
It's worth it to someone.