Python PoC Script Reproduces Steal My Bitcoin CTF Exploit

A single-file Python script named stealmybitcoin_poc.py reproduces the request sequence used to solve the Steal My Bitcoin CTF challenge. The exploit relies on triggering an Out of Memory condition to poison a worker and leak heap addresses. It uses a multipart upload to force PHP to chew through memory during session upload-progress parsing. The script sends at most 20 HTTP requests without looping or retries.

The heap leak stage produces a cookie that is 256 bytes long instead of the usual 32 bytes. The code leak stage produces a cookie that is exactly 16 bytes long containing a pointer to zval_ptr_dtor. The script checks the low 21 bits of the leaked pointer for the value 0x112930 to verify the correct Alpine build. The final request drops a forged PHP HashTable structure to trigger execution of the zif_system function. The command executed prints a fresh random nonce, the output of id, and the SHA-256 hash of the print-flag binary.

The exploit requires Python 3.11 or newer using only the standard library. It fails if the target is a Debian php:8.4.26-fpm stack due to different binary layouts. The producer sends 1,001 distinct empty cookie names in the request. The final POST request includes a 384-byte forged HashTable and a 276-byte primer. The exploit is considered stable once a container is up, with roughly seven out of ten consecutive runs succeeding. The script aborts before sending any packets if the target URL is not the challenge endpoint or a loopback lab URL.