More details about stealmybitcoin in LiveOverflow's video: https://www.youtube.com/watch?v=VhNiMWtOutw

This is the winner: https://github.com/KillaBoi/StealMyBitcoin-PoC

The challenge website was not exploitable at launch because it wasn't actually running PHP; it got cracked in two hours aftewards

In the video, LiveOverflow shows his exploit that reliably gets RCE from two requests.

> because it wasn't actually running PHP

Yea and no, I mean it was an even worse setup than typical, probably because the person setting it up didn’t have php experience or used an LLM that misinterpreted “route requests from nginx to php” or something too literally and set up a hacky solution.

But my impression isn’t that they set it up in some cheeky way to avoid exploits, it looks like they just asked for nginx to be in front.

And is “hacked in two hours” fair if they had to make it easy for people because their noob setup ended up not being exploitable?

Let me know if my read of what happened is wrong.