D-Link hedwig.cgi - Cookie bof - return to system

This is the second exploit from the advisory by Roberto Paleari (http://www.exploit-db.com/exploits/27283/). As in the module https://github.com/rapid7/metasploit-framework/pull/3385 I have created a ROP to system and this starts the telnetd.

![dlink_hedwig_cgi_bof](https://cloud.githubusercontent.com/assets/497520/3132822/8bd5fca2-e813-11e3-8fd3-a081bf87f8b2.png)

This vulnerability is not only in the DIR-645. It is also in the firmware of the DIR300 and DIR600. I think there could be other devices out there that are also vulnerable.
Can't we access the BadChars variable here and decide based on that which operator to use?