A single Python file exploits PHP's memory limit to steal Bitcoin CTF flag
Steal My Bitcoin CTF PoC
A public proof-of-concept for the Steal My Bitcoin CTF, written in one standard-library Python file. It walks PHP 8.4.26 through a memory-limit fatal during session upload-progress parsing, leaks a heap address and a code address through oversized session cookies, then forges a HashTable so cleanup calls zif_system and runs a command. The whole chain takes at most 20 HTTP requests, with no looping or retries, and runs against a local Docker lab.
With both addresses, a final request drops a forged PHP structure where cleanup will find it, and cleanup calls zif_system, PHP's handler for system.