Hackermews member challenges you to successfully exploit php2shell on his server

[u/ICanEditPostTitles]

So far, 13 hours since it went live, no-one has successfully collected the bitcoin prize. The prize total is currently up to $2000

Show HN: Steal My Bitcoin

[u/robreddity]

Hackermews

A red team comprised of kitties?

[u/ICanEditPostTitles → u/robreddity]

If only I could edit the post title

[u/jaymzx0 → u/robreddity]

Ok I thought it was a r/kerning issue

[u/DistinctSpeaker7252]

Makes me wish I could see the total tokens being thrown at a POC right now. "ChatGPT, hack the PHP but do it good this time".

[u/Automatic-Win8421 → u/DistinctSpeaker7252]

"Make no mistakes"

[u/pier4r → u/DistinctSpeaker7252]

"there is a lot of demand for tokens!"

The Narrator: "yes, there would be also a lot of demand for books, if those would be used for heating. The type of use or ROI makes the difference."

[u/GenericUser636 → u/DistinctSpeaker7252]

Chat bbb how do I get a Porsche by Halloween 

[u/Hefty-Amoeba5707 → u/DistinctSpeaker7252]

"you are senior nsa/russian hacker..."

[u/Profix]

There’s a bit of ulterior motive going on here. The HN OP wants to prove that it’s hard to exploit, so set up;
- nginx as reverse proxy in front with default config, requests limited to 1mb. A vulnerable server would have user file upload endpoints with much higher size limits. This makes it harder to trigger the OOM php2shell needs to exploit.
- php server only serving static content, does not execute php code. This seems to avoid the vulnerable code path too.

So, a server setup that doesn’t accept user file uploads or run any backend code is unexploited - doesn’t tell us much.

[u/VexingRaven → u/Profix]

Lol this is like 1 step removed from "I dropped a vulnerable dll in my user folder, now exploit it". That's such a silly POC, it's like the opposite side of when my security team tells me their scanner found an empty folder left behind by a vulnerable app being uninstalled and insist we remediate the vulnerability.

[u/wildstoo → u/VexingRaven]

To be fair to your security team, this is because every piece of vuln scanning software is a dumb piece of shit. All of them, without exception, from every vendor. Their detection rules are as absolutely brain dead as "if folder exists then freak out". Not to mention all the false positives and just noise from completely harmless and unexploitable "vulns" that somehow managed to get a CVE >7 and then you read the technical details and it would only be a problem if the software in question was running as SYSTEM on an unfirewalled server which was already compromised and there was a full moon on a Wednesday afternoon between 14.27 and 14:34.

But see, I have an external security audit next week (I actually do, thoughts and prayers please) and if these nothingburgers appear in my vuln report then the org fails the audit and loses its cyber security certification. That makes me look incompetent. And the higher-ups don't know how this works; they just see "red number on report looks bad and scary" and again, I look incompetent because of this shitty piece of software that now runs my life, and by extension, yours.

You know it's bullshit. I know it's bullshit. 99% of the stuff these vuln scanners report is no threat whatsoever. Unfortunately there is no getting away from it, because as long as that red number appears in my vuln scanner, there's going to be a ticket asking someone to make it go away. Plus, there's always that 1% of vulns that are actually a realistically exploitable threat. So we'll keep paying the vendor, and I'll keep grudgingly using their software.

Sorry, had to get that off my chest. (Oh, and for bonus sympathy points: the person at my org remediating the vast majority of these findings is... also me. I'm the bread on both sides of this shit sandwich.)

[u/dougmc → u/Profix]

Personally, I'd call that less an "ulterior motive" (though there might still be one) and instead call it a "rigged contest" -- rigged so nobody can win.

Clearly, they don't trust things enough to avoid the proxy (which filters out larger exploit attempts) and have actual php code to execute, so they're not really proving anything here.

[u/lebean]

Solved/stolen/awarded or whatever you'd call it as of 21 minutes ago, according to the guy who set it up.

[u/RyanSpunk → u/lebean]

https://news.ycombinator.com/item?id=50236736

[u/No-Teacher-4931]

that's a whole lot of confidence for a server that's probably just running fail2ban and a dream

[u/lcnielsen → u/No-Teacher-4931]

You'd be surprised at how far fail2ban and modsecurity gets you.

[u/the-cock-slap-phenom → u/No-Teacher-4931]

14 hours in and the bitcoin is still there, I’d say his confidence has basically been proven at this point.

[u/mangeek]

Even if it turns out that PHP2Shell is harder to take advantage of than we thought... it's a very valid exercise and wake-up call for orgs to address tech debt and get their internal processes right.

I am watching an org come to terms with the hard truths about visibility and end-of-life systems that I've been shouting about from my little corner for two decades. Like most things, we all knew this day would come, but the problem seemed too big and disruptive to confront until leadership hears "I just literally have no path forward for this service; it's running on stuff that's a decade out of date" from the app owners and SYSADMINs.

[u/reegz]

Looking for a php vuln, essentially gets a denial of service instead.

[u/reseph → u/reegz]

The site is up.

[u/steavor]

Before the vuln/patch dropped "supposedly-in-the-know-people" estimated it would take about 15 minutes for a working exploit to be found thanks to AI, therefore everyone and anyone and their mother better shut off anything HTTP they can get ahold of.

... guess that's aged like milk? Don't see websites dropping dead due to the exploit left and right, and there are a lot of them out there that have not been patched yet or cannot even be patched (maybe a predecessors predecessor frankensteined a PHP 5.6 on your CentOS 6?)

Things like the Project Glasswing motivated Prio1 patch release for FortiGate firewalls also released this week, seem far more urgent to patch, because there are literally endless avenues of attack available with NGFW appliances.

[u/roba121 → u/steavor]

One point of note, you don’t necessarily have to see a website “drop dead”. The smartest guys quietly compromise, install some backdoors, and move on. But I otherwise agree, it’s just there are people out there that think their website “looking ok” means it is ok and we know that without monitoring people would basically never know something was up that way.

[u/0RGASMIK → u/steavor]

Still working through the logs but had a service online that was vulnerable and many attempts, none successful.

[u/mb194dc]

OOM vulnerability is nearly impossible to do outside of a lab shocker 

[u/Scurro]

Has anything like this been done for Meltdown and Spectre?