KillaBoi/StealMyBitcoin-PoC
A public release of the Steal My Bitcoin challenge
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
sponsored with ❤️ by This README explains stealmybitcoinpoc.py, a single-file Python reproduction of the request sequence used in my Steal My Bitcoin CTF run. It uses only Python's standard library. The script builds the requests itself, checks each leak before moving on, and records the HTTP bytes from a new run. This can probably be done easier without all the extra debug crap and as in my John Hammond video about the Steam Local Privilege Escalation I discovered, you could probably clean up this ugly PoC. Everything below is written against the Docker lab, not the live challenge. The lab is a local Alpine PHP 8.4.26 CLI server behind nginx, which is the same build and worker model the offsets were calibrated on. Stand it up in a minute and the whole chain runs end to end on your own machine. The live run that actually solved the challenge is…
Read the full README ↗ · Preview checked 2026-11-01T01:44:30.048Z
Inside the original README — Document outline
- Steal My Bitcoin CTF proof of concept
- The short version
- Contents
- The lab
- Start here
- What each request does
- 1. How a small producer reaches the memory limit
- 2. How the heap address is recovered
- 3. How the PHP code address is recovered
- 4. How the final request reaches system
- Reading the result
- How often it actually works
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Documentation belongs to its respective authors. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
A public release of the Steal My Bitcoin challenge
Repository facts
- Owner
- KillaBoi
- Primary language
- Python
- Stars
- 1,028
- Forks
- 148
- Open issues + pull requests
- 3
- License
- Not reported — inspect the license file
- Archived
- No
- Default branch
- main
- Created
- 2026-10-25T21:48:32.000Z
- Last push
- 2026-10-26T11:25:47.000Z
Topics and intended use
No topics were included in the latest source metadata.
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-11-01T12:17:46.653Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.
Related repositories
EbookFoundation/free-programming-books
donnemartin/system-design-primer