Add Module and Documentation for CVE-2025-14558

[JohannesLks]

New Module: FreeBSD rtsold/rtsol DNSSL Command Injection (CVE-2025-14558)

Fixes #20789

This PR adds a new exploit module for CVE-2025-14558, a command injection vulnerability in FreeBSD's rtsol(8) and rtsold(8) daemons. The vulnerability arises from improper validation of the Domain Name Search List (DNSSL) option in IPv6 Router Advertisement (RA) messages, which are passed to the resolvconf(8) script without sanitization. An attacker on the local network can execute arbitrary commands as root by injecting shell metacharacters into the DNSSL domain field.

Verification

• Start msfconsole
• use exploit/freebsd/misc/rtsold_dnssl_cmdinject
• set INTERFACE <your_interface> (e.g., eth0)
• set CMD touch /tmp/pwned
• exploit
• Verify that Router Advertisement(s) sent successfully is displayed.
• Verify on the target machine (if available) that /tmp/pwned exists.

Demo / Proof of Concept

This module requires a FreeBSD target system (versions 13.x, 14.x, or 15.0 prior to 2025-12-16 patches) running rtsold with the -s flag.