Steal My Bitcoin CTF PoC

This is a Python proof of concept for a Bitcoin-themed capture-the-flag challenge. It automates a PHP memory-corruption chain using only Python’s standard library: multipart requests trigger excessive allocation while PHP processes session upload progress, and a memory-limit failure leaves stale state in a reused worker. Follow-up requests can expose heap data and a PHP function pointer through session cookies. The script validates those leaks before sending a final request that places a forged PHP HashTable where cleanup will process it, directing execution to PHP’s `system` handler. A successful run returns a fresh nonce, command output, and a flag-related result as evidence.

The exploit is calibrated specifically for Alpine PHP 8.4.26 running the built-in CLI server with four workers; a matching version on a different build may have incompatible addresses. The documented local Docker lab reproduces that environment, while the challenge’s live successful run is included only as historical context. The runner first checks the endpoint’s version, then performs up to two leak batches and one final callback, with no retries and a maximum of 20 HTTP requests. It checks response status, cookie lengths, pointer patterns, and agreement among candidate heap addresses. The README stresses that a memory-limit error or server failure alone does not demonstrate a leak or code execution, warns that the behavior is deliberately disruptive, and restricts the script to the challenge or a loopback lab.