The "Steal My Bitcoin" php2shell challenge was solved, but the timer is misleading. At first it was not exploitable, then the servers crashed, and the wallet was wrong. Here is everything that I learned while making my own exploit more reliable...
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
RESOURCES
Steal My Bitcoin challenge: https://stealmybitcoin.com/
If you want to try yourself: https://old.stealmybitcoin.com/
Challenge source code: https://github.com/pavja2/smbc-source-oct-2026
Killa's solution: https://github.com/KillaBoi/StealMyBitcoin-PoC
Killa on X: https://x.com/killa
Hacker News discussion: https://news.ycombinator.com/item?id=50224916
My first php2shell video, The race to the first exploit: https://www.youtube.com/watch?v=7CiZmq2llDg
Calif's original php2shell research: https://calif.io/php2shell/
PHP security advisories and updates: https://www.php.net/archive/2026.php
Thanks to James for hosting the challenge and Killa for sharing his result with me.
CHAPTERS
00:00 - The Bitcoin challenge was solved
01:52 - Investigating the challenge's server setup
04:34 - The missing PHP file...
05:54 - The wallet was wrong too...
07:25 - Making my php2shell exploit more reliable
10:02 - Last-byte synchronization
11:48 - Solving the challenge
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#PHP2SHELL
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
RESOURCES
Steal My Bitcoin challenge: https://stealmybitcoin.com/
If you want to try yourself: https://old.stealmybitcoin.com/
Challenge source code: https://github.com/pavja2/smbc-source-oct-2026
Killa's solution: https://github.com/KillaBoi/StealMyBitcoin-PoC
Killa on X: https://x.com/killa
Hacker News discussion: https://news.ycombinator.com/item?id=50224916
My first php2shell video, The race to the first exploit: https://www.youtube.com/watch?v=7CiZmq2llDg
Calif's original php2shell research: https://calif.io/php2shell/
PHP security advisories and updates: https://www.php.net/archive/2026.php
Thanks to James for hosting the challenge and Killa for sharing his result with me.
CHAPTERS
00:00 - The Bitcoin challenge was solved
01:52 - Investigating the challenge's server setup
04:34 - The missing PHP file...
05:54 - The wallet was wrong too...
07:25 - Making my php2shell exploit more reliable
10:02 - Last-byte synchronization
11:48 - Solving the challenge
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#PHP2SHELL
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.