There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.
It clearly isnt happening.
right: either it’s so hard to exploit that $1,000 isn’t enough to risk “giving away” your exploit chain or actual exploitation of this bug is impractical, either way the CVEpocalypse is overblown
OP just posted that there's a solve. And from a previous update thread apparently their first config was not actually exploitable? So ... seems like it is happening. Maybe not instantly, at least not if the site just remains down for hours because it's functionally DoSed, but it still is apparently exploitable.
yeah between updating the challenge and it getting solved only like a bit over 2 hours passed and that is with the server probably still being super overloaded
> Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page
Yeah, AI seems like a good shift in "narrative making." It's easy to ask AI "give me an efficient way to "confirm or deny this narrative" and have something like this go viral. This is good because it makes narratives more truthful
Because only a fraction of people would double check (AI or otherwise), AI making it easier to flood the zone with fine tuned spam actuallu has the opposite effect. We're seeing this at play at a large scale anywhere an election is happening right now. The narratives are even less truthful than before.
Wow we have lost it. You really need AI to come up with something like this… let’s just end it at this point honestly.
Can you ask your favorite „AI” to comment on what you’ve just said?
It seems like the server got DDoS’d before anyone got to the bitcoin.
What point is an anonymous online post proving? Can anyone verify that the private key actually exists? Or which version of PHP the site is running? Or if it is running PHP at all?
If someone was able to gain access to the server and there was no key, they would report it here with proof. If someone had a working PHP exploit and it didn't work on this server, they would be able to post it here with proof.
I just hacked the site and wasn't able to find any key. Do you believe me? Why not? I posted exactly as much proof as the person who posted the challenge.
Wow i don’t know… maybe modify the web page to have your username on it. No wow that is too hard for you leet haxers. Are you really this dumb you can’t figure out any of the hundreds of way to show proof?
But they just showed you their proof. You simply did not accept it, which they might or might not care about.
I suspect that they in fact do not particularly care about what you think.
Shut the server down or deface it and I'll believe you. Should be simple if you've gained shell access.
Joke's on you, I hacked the server first and patched the PHP
I reconfigured nginx on one of my servers to log all attempted multipart POST requests. Been tailing the log, and while there is a trickle of entries, they all are for empty forms, none are php2shell specific.
Interestingly enough, virtually all of these come from the Google Cloud IP space. There was a single hit from China and two from Europe.
You can see the commenters arguing with me about ASLR in the old thread. Half the commenters here, including quite a few "thought leaders" (not gonna name names or ad hominems but everybody knows who they are), insist that there are ways to implement this exploit at scale without having to do rowhammer-style spam brute forcing. I am still waiting. There's a lot of FUD and hearsay in the tech circles grapevine but very little evidence of actual working exploits against a modern Linux server outside of "attempts".
https://news.ycombinator.com/item?id=50188948
I am still waiting for them to put their money where their mouth is.
Maybe link to the argument? I can only find two comments from you on that post and only one person replied. That one reply isn’t from a “thought leader” either.
He meant tptacek, I guess.
Sometimes thought leaders make mistakes ;-)
> There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view.
Clearly people aren't cynical enough.
I find it strange no one in this thread has even considered the possibility that the private key of the wallet isn't on the machine.
OP gets their working exploit neatly logged (or even multiple approaches), keeps the money, strengthens the illusion the exploit isn't that bad, and gets a free $500 on top from someone who added to the wallet.
Except, it’s the top entry in HN right now. It could have gone down to the hug 20 minutes after it was posted, so nobody much has had a chance to have a go at it.
no it doesn't . absence of evidence is not evidence of absence
This is evidence of absence, though. Unexploited PHP servers are evidence of absence of exploits, and exploited PHP servers are evidence of presence of exploits. “Absence of evidence” would be if there were no PHP servers.
An unexploited PHP server means "there exists a configuration that is not exploitable".
Which is how hundreds of previous exploits have had people publish information on what to temporarily tweak/disable/block, such that the exploit wouldn't work.
What is novel about this case, and for which i do not know the explanation, is that nobody in-the-know was willing to confirm them before the CVE dropped.
> An unexploited PHP server means "there exists a configuration that is not exploitable".
No it doesn’t. An equally plausible explanation is that nobody has tried. (Replace “PHP server” with “someone’s vehicle.”)
The value proposition isn't there.
If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
That's pennies for something like this.
Add two zeros and it might get nabbed.
Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.
exactly. the pros are not going to reveal their hand for $1k
That is sort of the point I thought? There’s no low skill exploit for the script kiddies to use even with AI, otherwise they’d happily use it
The pros have RCEs, but won’t burn it for something this small.
It’s a real vulnerability, but a complex one
Why not? Those pros have their opportunity to use this exploit dwindling by the hour as news of this and pressure to patch grows and grows. All the major managed hosting companies had this patched in the first 24 hours.
I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.
> The value proposition isn't there.
That's part of the point. $500 or $1000 is a trivial amount. Since the money is still there, there's currently no trivial exploit.
> requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done
Depending on the exploit, and the visibility stack on the server, one may or may not be able to determine how the rabbit got in the hat.
I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?
This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.
random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.
based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.
So your answer is people could hack this easily but logs scare them?
Well that's good news because my webserver also has logging
> that's good news because my webserver also has logging
In the future, every website will carry a little blurb of text in the footer of their pages intended to scare off would-be hackers and their AI agents:
“The server of this website employs append-only remote logging and state-of-the-art monitoring and intrusion detection. Unauthorized access or attempts there of WILL be prosecuted to the fullest extent of the law. The outcome of such prosecution is and always will be astronomical amounts of money in damages that the guilty party will pay to the victim, alongside decades of prison time for the party guilty of computer crimes. Do not even try.”
Or rather "the software on this server is fully patched and everything is logged. If you hack it, we will sell the 0-day you used before you can".
"First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org."
What risk?
That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.
The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.
I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.
You’re upset that it wasn’t exploited as fast as people were concerned it was going to be?
It may not have happened this time, but we are rapidly approaching a future where this will be the case for every exploitable bug.
It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.
You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.
Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.
So you are therefore arguing for the author's point.
The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.
In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.
The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.
Wallet address is there, you can donate
My favourite actively unreleased 0 day exploits are the ones that are released, 5 days old, and allegedly so trivial to exploit it costs $5 in tokens.
No, I will not spend $5 in tokens to claim your $1000 bounty. My $5 exploit is worth more than $1000. Thank you very much.
The whole point was someone could throws some cents and hack the site.
This logic doesn't work here, because it relies on the premise that you alone potentially have an unreleased zero-day exploit, which is not the case.
If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.