They can be running a vulnerable version of PHP but also recording all traffic in a way that does not allow for wiping evidence afterwards. For example, if the PHP server was behind another server routing the raw IP packets and running tcpdump. Since the author of the site controls the TLS cert private key, TLS does not protect again the author eavesdropping.
replyThe exploit gives you access to a machine, not necessarily the one terminating TLS and keeping logs.
replyAfter the fact you are going to clean an append-only log on a separate box?
replyreally?
reply1. there's no actual evidence that the key to the wallet is on this machine at all. it would be trivial to add a service that would sign challenges to prove so
2. a working RCE against PHP is worth much more than $1000, attacking this machine would easily burn that
Serious question: Worth more how?
reply>it would be trivial to add a service that would sign challenges to prove so
replyIf the author was being dishonest about the key, they could just keep the key on another secure server and have the vulnerable one forward the challenge requests to it.
fair
reply