A public experiment that allowed hacking of a web server without security updates, with a bitcoin bounty at stake, ended in success after about 19 hours. But the server was breached in about 3 hours once the environment for a real attack was in place, raising concerns about PHP security vulnerabilities.

On Oct. 26 (local time), Japan's GigaZine reported that the hacking challenge "Steal My Bitcoin" set up by security researcher James Pavur (제임스 파부르) ended after participant KillaBoi (킬라보이) succeeded. The experiment was conducted to see whether the recently discovered critical PHP vulnerability "PHP2Shell" could be abused to attack real servers.

The operator made a PHP 8.4.26 server without a security patch publicly accessible and had participants break in and find the private key to a bitcoin wallet.

The prize initially stood at about $500 (about 661,900 won) but rose to about $2,000 (about 2,647,400 won) with additional donations. The scope of the attack was limited to the web application and the PHP runtime environment, while attacks on server infrastructure or denial-of-service were banned.

After more than 17 hours passed without a winner, participants raised concerns that there was a problem with the server configuration. Security researcher LiveOverflow (라이브오버플로) explained that a page for running PHP programs on the server had not been made public.

The operator later added the page, and about 3 hours later KillaBoi succeeded in breaching the server. The challenge lasted 19 hours and 17 minutes from start to finish.

KillaBoi said the attack exploited a flaw in the process of handling out-of-memory conditions in PHP to obtain internal server information and execute remote commands. The participant posted the attack process on GitHub.

But the participant was unable to transfer the prize directly because the operator had stored an incorrect bitcoin private key on the server. The operator paid 0.02511679 BTC as the prize after confirming the successful intrusion.

The experiment shows that, under certain conditions, PHP2Shell can lead to real server compromise.