UK pentester claims $2,000 Bitcoin prize for PHP2Shell CTF RCE
Original title: UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest
Jaydip Modhwadia says he achieved remote code execution in about three hours after a PHP endpoint was added.
UK pentester Jaydip Modhwadia, known as Killa, won a Bitcoin prize for remote code execution in James Pavur's PHP2Shell capture-the-flag contest. Pavur launched Steal My Bitcoin on October 24 to test whether the bug was as easy to exploit as claimed. The site initially served static HTML; Modhwadia got code execution at 1547 UTC on October 25 after a PHP endpoint was added. He published a write-up and a single-file Python script. Hudson Rock's Alon Gal said the result was target-specific and not evidence of scalable automated compromise.
Unconfirmed: The site timer showed 19.28 hours, but Modhwadia says the actual effort was about three hours.
- Pavur first offered $500; the community raised the award to $2,000.
- The site displayed 19.28 hours, while Modhwadia says the work took about three hours.
- His script, he says, needs at most 20 HTTP requests to finish the exploit.
- He says the method bypasses ASLR and other recently disclosed barriers.
- He donated part of the prize to the Lupus Foundation.
Impact: Remote code execution on the contest website
| Product | Affected |
|---|---|
| PHP | — |
- Products
- PHP
- Organizations
- Hudson RockVulnCheck
- Countries
- United Kingdom
From the original article
3 min read at theregister.comJaydip Modhwadia beats challenge designed to test real-world exploitability of PHP2Shell in around 3 hours
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.