Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization RCE

This repository is a Proof-of-Concept (PoC) exploit for CVE-2025-30406, a ViewState deserialization vulnerability in ASP.NET applications. The exploit consists of two main Python scripts: 1. 'exploit.py' is the primary exploit script. It uses ysoserial to generate a malicious ViewState payload with a hardcoded validation key and generator. The payload executes an arbitrary command on the target server. If a callback URL is provided, the command is wrapped in PowerShell to send its output to an attacker-controlled HTTP server via HTTP GET. The script sends the payload to a user-specified vulnerable ASP.NET endpoint via POST, embedding it in the '__VIEWSTATE' parameter. 2. 'server.py' is a simple HTTP server that listens (by default on port 8000) for GET requests containing exfiltrated command output. It displays the output in a styled format with timestamps and colored prompts for readability. The repository also includes a detailed README.md with setup, usage instructions, and ethical warnings. The exploit requires the attacker to know the ViewState validation key and generator for the target application, and to have ysoserial available. The exploit is a POC and not weaponized, as it requires manual setup and hardcoded values. The main attack vector is network-based, targeting vulnerable ASP.NET endpoints over HTTP. Fingerprintable endpoints include the target ASP.NET URL and the attacker's callback server for exfiltration.

This repository provides a working exploit for CVE-2025-30406, a critical remote code execution vulnerability in Gladinet CentreStack and Triofox (tested on version 16.1.10296.56315 for Windows). The exploit is implemented in C# (.NET 4.7.2) and generates a malicious ViewState payload containing a serialized XAML object (rce.txt) that triggers arbitrary command execution on the target server. The main entry point is Program.cs, which handles ViewState generation and signing. The README provides usage instructions, including how to use ysoserial.net to generate payloads and target the vulnerable endpoint (/portal/loginpage.aspx). The exploit requires knowledge of the ViewState validation key, which is provided in the README for demonstration. The payload can be customized to execute arbitrary commands, either by modifying the XAML or by sending a custom 'cmd' HTTP header. The repository also includes references to public advisories and detection templates. No evidence of fake or detection-only code was found; this is a functional exploit for RCE via .NET deserialization.