# Gladinet CentreStack/Triofox: Cryptography Vulnerability

Hardcoded AES keys in Gladinet CentreStack/Triofox let attackers forge filesvr.dn access tickets to read web.config, then ViewState deserialize to RCE.

- Payout: Real-world hack
- Severity: high
- Program: Gladinet CentreStack
- Credited: Huntress
- Disclosed: 2025-12-18
- CVE: CVE-2025-14611, CVE-2025-11371
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-active-exploitation-gladinet-centrestack-triofox-insecure-cryptography-vulnerability
- Tags: domain:web impact:data-leak impact:rce kind:incident platform:threat-intel sev:high tech:dotnet technique:chained technique:reverse-engineering vuln:auth-bypass vuln:crypto vuln:deserialization vuln:rce

**Target:** IIS-hosted CentreStack/Triofox filesvr.dn HTTP handler
**Root cause:** GenerateSecKey in GladCtrl64.dll returns static 100-byte strings (Chinese text for SysKey, Japanese marketing text for IV) used as AES-256 key and IV, so tickets are forgeable/decryptable by anyone who extracts them once.
**Steps:**
1. Extract static SysKey/SysKey1 from GladCtrl64.dll memory (or debug running w3wp process)
2. Build AES-256-CBC ticket: first 32 bytes of SysKey as key, first 16 bytes of SysKey1 as IV
3. Plaintext ticket = newline-separated `C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config`, blank username, blank password, timestamp `9999-11-27 14:52:04.009217`
4. URL-safe encode (`+`->`:`, `/`->`|`), Base64, send `GET /storage/filesvr.dn?t=<ticket>`
5. Receive web.config containing machineKey
6. Forge ASPX ViewState with machineKey and POST to trigger deserialization RCE
**How found:** Huntress inspected Gladinet-provided IoC requests to /storage/filesvr.dn, recognized the t param as an encrypted access ticket, traced decryption to AccessTicket.Decrypt and SysKeyMgr, then debugged the running process and found GenerateSecKey returns identical static strings every start.
**Exploitation:** Attacker forges non-expiring ticket (year 9999) with blank creds falling back to app pool identity, downloads web.config, extracts machineKey, then performs ViewState deserialization to execute code; observed PowerShell downloading conqueror.exe from 185.196.11.207:8000 via w3wp.exe.
**Escalation:** web.config read -> machineKey extraction -> ViewState deserialization RCE -> host enumeration and payload download; chained after prior CVE-2025-11371 exploitation.
**Insight:** When a vendor ships IoCs containing encrypted blobs, decode them: the plaintext structure (filepath, creds, timestamp) reveals the ticket format, and debugging the key-generation function shows whether keys are static across restarts.