Pentester Claims $2,000 Bitcoin Prize After Proving PHP2Shell Flaws Can Be Exploited

A UK-based developer and pentester, Jaydip Modhwadia (known as "Killa"), has claimed a $2,000 Bitcoin prize for showing that the PHP2Shell vulnerabilities can be exploited in practice. The vulnerabilities caused widespread disruption online last week, according to The Register.

The prize was offered by James Pavur through a "Steal My Bitcoin" capture-the-flag challenge launched on October 24. Pavur wanted to test claims from the security community that the exploit was easy to use, and he offered a reward to anyone who could achieve remote code execution (RCE) on his website. The prize was initially $500, and the community raised it to $2,000.

Early participants complained that the site served only static HTML, so the exploit could not work. The site ran a vulnerable version of PHP, but the exploit path needed a PHP file to act as a hook. Pavur appears to have updated the site around 1300 UTC on October 25, and Modhwadia achieved RCE at 1547 UTC. The site shows 19.28 hours, but he says the real time was around three hours, because heavy traffic made the site largely unusable. He published a write-up of a single-file Python script that he says needs at most 20 HTTP requests. The challenge drew a huge number of attempts, even though Pavur set a 1MB request limit on Nginx.