# Active Exploitation of Gladinet CentreStack and Triofox

Unauthenticated path traversal in Gladinet CentreStack/Triofox /storage/t.dn leaks Web.config machine key, enabling ViewState deserialization RCE.

- Payout: Real-world hack
- Severity: critical
- Program: Gladinet CentreStack
- Credited: Huntress
- Disclosed: 2025-10-15
- CVE: CVE-2025-11371
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/gladinet-centrestack-triofox-local-file-inclusion-flaw
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-gladinet-centrestack-triofox-local-file-inclusion-flaw
- Tags: domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet technique:chained technique:recon vuln:deserialization vuln:info-disclosure vuln:path-traversal vuln:rce

**Target:** CentreStack/Triofox web app /storage/t.dn temp download handler (GSUploadDownloadProxy.dll)
**Root cause:** GladinetStorage.TempDownload.ProcessRequest builds a path from TempRoot (C:\Windows\Temp\glad_temp) plus the user-supplied `s` parameter without sanitizing `..\` traversal, and the endpoint is unauthenticated.
**Steps:**
1. Recon target via FOFA referrer; GET /portal/loginpage.aspx returns 200.
2. Send `GET /storage/t.dn?s=..\..\..\Program+Files+(x86)\Gladinet+Cloud+Enterprise\root\Web.config&sid=1` to retrieve Web.config (200, ~1497 bytes).
3. Extract machineKey validation/decryption keys from Web.config.
4. Forge a ViewState payload (ysoserial.net) signed with the leaked key and POST it to the app to trigger deserialization RCE.
5. Run `ipconfig /all > C:\programdata\CentreStac_log.txt` via the deserialized payload, then retrieve output with `GET /storage/t.dn?s=..\..\..\programdata\CentreStac_log.txt&sid=1`.
**How found:** Huntress SOC detector for post-exploitation of prior CVE-2025-30406 fired on a host running a patched version, prompting log review; the unusual GET to /storage/t.dn with `..\` traversal and 1497-byte response revealed the LFI, and code review of GSUploadDownloadProxy.dll confirmed the missing sanitization.
**Exploitation:** Attacker used FOFA to find exposed CentreStack instances, hit the unauthenticated /storage/t.dn handler with directory traversal to read Web.config, extracted the machineKey, then forged a signed ViewState payload to achieve deserialization RCE as NT AUTHORITY\SYSTEM. Blind command output was redirected to a file and exfiltrated via the same LFI endpoint.
**Escalation:** LFI (info disclosure of machine key) chained into ViewState deserialization for full RCE; blind command execution turned interactive by writing output to disk and re-reading via LFI.
**Insight:** When a prior RCE (ViewState deserialization) is patched by rotating keys, look for any unauthenticated file-read primitive that can re-leak the new machineKey — the fix is only as strong as the secrecy of Web.config. Also: blind RCE output can be exfiltrated by writing to disk and re-reading via the same LFI.