Steal My Bitcoin CTF PoC 攻击链完整解析

安全研究人员公开发布了针对 Steal My Bitcoin CTF 挑战的完整利用概念验证代码。1 该攻击针对 Alpine 上运行的 PHP 8.4.26（CLI 服务器配置、4 个工作进程）展开，通过精心构造的多部分上传请求触发 PHP 内存溢出漏洞。1

整个攻击链分为四个阶段，最多需要 20 个 HTTP 请求完成。1 首先通过健康检查验证目标，随后利用两个独立的泄露阶段分别获取堆内存信息和代码地址信息——每个泄露阶段需要 9 个请求。1 堆泄露返回包含 Zend 块基址的 256 字节 Cookie，代码泄露则返回包含 zval_ptr_dtor 函数指针（特征值 0x112930）的 16 字节 Cookie。1 在内存限制 128 MiB 的约束下，耗尽条件会触发工作进程中的过时状态，为后续攻击创造条件。1

最终阶段通过提交 368,812 字节的伪造 HashTable 结构的 POST 请求，触发 zif_system 函数执行任意命令。1 命令输出通过 /proc/self/fd 重定向至 HTTP 响应。1 在实验室环境中，该攻击成功率约为 70%（10 次运行中约 7 次成功）。1 攻击于 2026 年 10 月 25 日 15 时 47 分 38 秒 UTC 执行，虽然成功读取了比特币私钥，但恢复的 WIF 与挑战中公布的比特币地址不匹配。1

A complete proof-of-concept exploitation technique for the Steal My Bitcoin Capture The Flag challenge has been detailed, demonstrating a sophisticated attack chain targeting PHP 8.4.26 running on Alpine with a CLI server and four workers 1. The exploit leverages a carefully crafted multipart upload request to trigger a PHP memory overflow, ultimately enabling remote command execution and recovery of a Bitcoin private key 1.

The attack unfolds across four distinct stages requiring a maximum of 20 HTTP requests 1. The process begins with a health check, followed by nine requests per leak batch to extract sensitive information 1. A heap memory leak returns a 256-byte cookie containing the Zend chunk base address, while a subsequent code leak yields a 16-byte cookie with a zval_ptr_dtor function pointer bearing the fingerprint 0x112930 1. The final stage deploys a 368,812-byte POST request containing a forged HashTable structure, triggering zif_system execution 1. Command output is redirected through /proc/self/fd to reach the HTTP response 1.

The attack succeeded with an approximate success rate of 7 out of 10 runs against the lab setup 1. The exploit was executed on 25 October 2026 at 15:47:38 UTC, with the system operating under a memory limit of 128 MiB; exhaustion of this limit triggers stale state in a worker 1. While the Wallet Import Format (WIF) was recovered through this technique, it did not match the Bitcoin address advertised by the challenge creator, attributed to a creator error 1.