Watch · Hacking and CTFs
The $2,000 php2shell Challenge Was Unexploitable
The Brief
- The video revisits the php2shell 'Steal My Bitcoin' challenge, which was solved, though the timer is described as misleading.
- It covers the challenge being initially unexploitable, servers crashing, and the wallet being wrong.
- It investigates the challenge's server setup, including a missing PHP file.
- It explains how the presenter made his own php2shell exploit more reliable, including last-byte synchronization.
Why watch · Developers interested in PHP exploitation and web security may find the walkthrough of making an exploit more reliable useful.
- php2shell
- PHP
- Steal My Bitcoin
- Exploit development
Summarised by Claude from the video’s title and description – YouTube doesn’t make transcripts available, so check the video for the details.
Chapters
Show the full video description ›Hide the video description
The "Steal My Bitcoin" php2shell challenge was solved, but the timer is misleading. At first it was not exploitable, then the servers crashed, and the wallet was wrong. Here is everything that I learned while making my own exploit more reliable... LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy RESOURCES Steal My Bitcoin challenge: https://stealmybitcoin.com/ If you want to try yourself: https://old.stealmybitcoin.com/ Challenge source code: https://github.com/pavja2/smbc-source-oct-2026 Killa's solution: https://github.com/KillaBoi/StealMyBitcoin-PoC Killa on X: https://x.com/killa Hacker News discussion: https://news.ycombinator.com/item?id=50224916 My first php2shell video, The race to the first exploit: https://www.youtube.com/watch?v=7CiZmq2llDg Calif's original php2shell research: https://calif.io/php2shell/ PHP security advisories and updates: https://www.php.net/archive/2026.php Thanks to James for hosting the challenge and Killa for sharing his result with me. CHAPTERS 00:00 - The Bitcoin challenge was solved 01:52 - Investigating the challenge's server setup 04:34 - The missing PHP file... 05:54 - The wallet was wrong too... 07:25 - Making my php2shell exploit more reliable 10:02 - Last-byte synchronization 11:48 - Solving the challenge SUPPORT Per video: https://www.patreon.com/join/liveoverflow Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: https://www.youtube.com/LiveUnderflow Twitch: https://twitch.tv/LiveOverflow/ Twitter: https://twitter.com/LiveOverflow/ Instagram: https://instagram.com/LiveOverflow/ TikTok: https://www.tiktok.com/@liveoverflow_ LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #PHP2SHELL (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
