Steal My Bitcoin

What happened

Someone set up a live test server with a bitcoin key hidden on it. The key controls a small crypto wallet. The goal is to get into the server and take the money. The page says no successful hack has happened yet, so the wallet is still full.

Key facts

• The wallet holds about $500 worth of Bitcoin.
• 0.00 hours have passed without a successful hack.
• The hidden key can be reached through a program called print-flag, using the PHP user account.
• The server runs an older PHP version, chosen from before the PHP2SHELL security flaws were made public.

Why this is a challenge

PHP is a common programming language used to build websites. Older versions can have known weaknesses. A CVE is a public code for a known security flaw. This challenge was set up as a practice test to see who can find a way in. The organizers also invite winners to donate the money to charity, such as GiveWell, if they do not need it.

Why it matters

The challenge shows how an old, known weakness can let an attacker take control of a server and its money. It is a clear reminder for anyone running websites to keep software updated and to protect secret keys.

What to watch

• Whether anyone gets into the server and takes the wallet.
• How long the wallet stays untouched.
• Whether the winner donates the money to charity, as the organizers suggest.