UK pentester 'killa' claims $2K Bitcoin prize in PHP2Shell capture-the-flag contest

A UK-based developer and pentester has claimed a $2,000 Bitcoin prize for demonstrating the exploitability of the PHP2Shell vulnerabilities that melted the internet last week.

Jaydip Modhwadia, 26, otherwise known as “Killa,” claimed the prize set by James Pavur, who launched the "Steal My Bitcoin" site on October 24.

Pavur launched the CTF (capture the flag) challenge to prove that the PHP2Shell exploit was not as easy as those in the cybersecurity community claimed it to be, promising to award $2,000 in Bitcoin to anyone who could achieve Remote Code Execution (RCE) on his website.

"My Bitcoin was stolen after 19.28 hours," the website now says, after Modhwadia claimed the prize, although the real time taken is thought to be less than three hours.

Soon after Pavur launched the CTF on Saturday, prospective flag-catchers complained that the website he set up, which served only static HTML, was not built in a way that allowed the PHP2Shell exploit to achieve RCE.

The web page was running a vulnerable version of PHP, but the exploit path required a vulnerable website to serve a PHP file for flag-catchers to use as a hook – something that Pavur seemingly updated at around 1300 UTC on October 25.

Modhwadia achieved RCE on the website, exposing a PHP endpoint, at 1547 UTC.

After an error from Pavur placing the wrong wallet key on the server, the CTF creator sent Modhwadia his award, which the community upped to $2,000 from Pavur’s initial $500.

The pentester published a write-up of his method, a single-file Python script he says requires 20 HTTP requests "at most" to fully execute.

Speaking to The Register, Modhwadia also confirmed that he got the flag in "around three or so hours in total." He said he followed the news about the competition, "but didn't attempt it until it gained significant notice."

If he had attempted it before Pavur introduced the endpoint, he may have struggled. For hours, bug bounty hunters were trying to access the website to attempt the challenge, as news of the CTF had exploded across tech circles.

"The fact that it took 19 hours was because after it went popular, the entire site became basically unusable for anyone at all," Modhwadia added.

The challenge saw a huge number of attempts, despite Pavur's decision to introduce a prohibitive 1MB request limit on Nginx.

Alon Gal, co-founder and CTO at Hudson Rock, commended Modhwadia's work, but added that his success achieved in just a few hours should not be taken to mean that the same attack could be automated at scale.

He said: "Does this mean autonomous AI agents can now compromise arbitrary PHP servers at scale? No. This was a sophisticated, target-specific exploit.

"But it does demonstrate that PHP2Shell can be weaponized against a live target, even with meaningful technical constraints."

Modhwadia's proof of concept is not the first to prove PHP2Shell is exploitable, but it falls under the more advanced category.

Early signs suggested that Address Space Layout Randomization (ASLR) on a vulnerable server would prove a significant barrier to real-world exploitation, and the pentester’s solution bypasses it, along with the others that were disclosed recently.

Spencer McIntyre, director of exploit development at VulnCheck, told The Register last week that attackers are finding new ways to exploit PHP2Shell, and "are clearly spending time (and tokens) on this bug."

Initially, experts said exploit code was being found online hours, or even days, before the vulnerabilities were disclosed publicly, which led to millions of exploit attempts, although it was too early to determine the efficacy of these on real-world systems.

Scores of websites were taken down for maintenance last week as organizations raced to protect themselves from the attacks, which may or may not have proved successful.

Modhwadia said he donated a portion of the prize he received to the Lupus Foundation to raise awareness about the condition, from which he also suffers. ®