Hardcoded machineKey ViewState RCE in Gladinet CentreStack and Triofox

This repository is a Proof-of-Concept (PoC) exploit for CVE-2025-30406, a ViewState deserialization vulnerability in ASP.NET applications. The exploit consists of two main Python scripts: 1. 'exploit.py' is the primary exploit script. It uses ysoserial to generate a malicious ViewState payload with a hardcoded validation key and generator. The payload executes an arbitrary command on the target server. If a callback URL is provided, the command is wrapped in PowerShell to send its output to an attacker-controlled HTTP server via HTTP GET. The script sends the payload to a user-specified vulnerable ASP.NET endpoint via POST, embedding it in the '__VIEWSTATE' parameter. 2. 'server.py' is a simple HTTP server that listens (by default on port 8000) for GET requests containing exfiltrated command output. It displays the output in a styled format with timestamps and colored prompts for readability. The repository also includes a detailed README.md with setup, usage instructions, and ethical warnings. The exploit requires the attacker to know the ViewState validation key and generator for the target application, and to have ysoserial available. The exploit is a POC and not weaponized, as it requires manual setup and hardcoded values. The main attack vector is network-based, targeting vulnerable ASP.NET endpoints over HTTP. Fingerprintable endpoints include the target ASP.NET URL and the attacker's callback server for exfiltration.

This repository contains a single Metasploit module targeting CVE-2025-30406, a critical ViewState deserialization vulnerability in Gladinet CentreStack and Triofox web applications for Windows. The exploit leverages a hardcoded machineKey found in the IIS web.config file, allowing attackers to forge ViewState payloads that pass integrity checks. By sending a specially crafted ViewState parameter to the '/portal/loginpage.aspx' endpoint, the module achieves remote code execution (RCE) on vulnerable servers. The module is weaponized, supporting arbitrary command execution via the Metasploit payload system. The code is written in Ruby and follows standard Metasploit module structure, with clear separation of check, exploit, and payload generation logic. The exploit is network-based and requires the target application to be accessible over HTTP/HTTPS. No static IPs or domains are hardcoded; the main fingerprintable endpoint is the application path and the use of the hardcoded machineKey in the configuration file.

This repository provides a working exploit for CVE-2025-30406, a critical remote code execution vulnerability in Gladinet CentreStack and Triofox (tested on version 16.1.10296.56315 for Windows). The exploit is implemented in C# (.NET 4.7.2) and generates a malicious ViewState payload containing a serialized XAML object (rce.txt) that triggers arbitrary command execution on the target server. The main entry point is Program.cs, which handles ViewState generation and signing. The README provides usage instructions, including how to use ysoserial.net to generate payloads and target the vulnerable endpoint (/portal/loginpage.aspx). The exploit requires knowledge of the ViewState validation key, which is provided in the README for demonstration. The payload can be customized to execute arbitrary commands, either by modifying the XAML or by sending a custom 'cmd' HTTP header. The repository also includes references to public advisories and detection templates. No evidence of fake or detection-only code was found; this is a functional exploit for RCE via .NET deserialization.