Huntress Team
Source-scoped identity with 3 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 3 PoCs on this page
MetasploitGladinet CentreStack/Triofox Path Traversal
Metasploit auxiliary PoCby Julien Voisin, plus 2 additional contributorsAdded to Metasploit 2026-02-04ExploitCVE-2025-11371CVE-2025-304061 file
Analysis
Technical assessment
A Metasploit auxiliary module that exploits CVE-2025-11371, an unauthenticated path traversal vulnerability in Gladinet CentreStack/Triofox, to read arbitrary files from the server. It includes actions to read any file or specifically extract the machineKey from Web.config for use in further attacks.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that exploits CVE-2025-11371, a path traversal vulnerability, to read arbitrary files. It contains no backdoor, concealed payload, or operator-directed harm. All behavior is consistent with documented exploit functionality.
Classification basis and observed behavior
Classification basis
The module actively sends crafted requests to exploit a path traversal vulnerability and retrieve file contents, which constitutes exploitation rather than mere scanning or detection.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:18-20modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77Requirements
- Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.10.10408.56683).
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:27-28 - The /storage/t.dn endpoint must be accessible and accept the 's' parameter with traversal sequences.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:22-23
Observed behavior
- Sends an HTTP GET request to /storage/t.dn with a path traversal payload in the 's' parameter to read an arbitrary file.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77 - If the response status is 200, the file content is returned and stored as loot.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:89-96 - The EXTRACT_MACHINEKEY action reads Web.config and extracts the machineKey for use in ViewState deserialization attacks.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-148
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module sends a GET request with a traversal path in the 's' parameter to read arbitrary files, matching the described vulnerability.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77 - File Read
- Payload withheldThe EXTRACT_MACHINEKEY action reads a file and passes content to handle_machinekey_extraction, which is a standard Metasploit mixin for extracting cryptographic keys.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-149 - Loot Storage
- Payload withheldThe module uses store_loot to save the retrieved file, which is normal Metasploit behavior for auxiliary/gather modules.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:116-125
What the analysis did not establish
- Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full exploit chain (e.g., handle_machinekey_extraction) is not visible.
- The review covers only the module source file; framework mixins (e.g., Msf::Auxiliary::Gladinet, handle_machinekey_extraction) are not expanded, but their use is standard and non-suspicious.
- Binary files are not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGladinet CentreStack/Triofox Access Ticket Forge
Metasploit auxiliary PoCby Julien Voisin, plus 1 additional contributorAdded to Metasploit 2026-02-04ExploitCVE-2025-146111 file
Analysis
Technical assessment
A Metasploit auxiliary module that forges access tickets using hardcoded AES keys to read arbitrary files from vulnerable Gladinet CentreStack/Triofox servers, and can extract the machineKey from Web.config for potential RCE.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that exploits CVE-2025-14611 to forge access tickets for arbitrary file read. It uses hardcoded AES keys, constructs a plaintext ticket, encrypts it, and sends it to the target. No backdoor, concealed operator-directed harm, or unrelated payload is present. The module's behavior is fully consistent with its documented purpose.
Classification basis and observed behavior
Classification basis
The module actively forges cryptographic tickets to read arbitrary files from a remote server, which constitutes exploitation of the hardcoded key vulnerability (CVE-2025-14611). It does not merely detect or scan; it performs the unauthorized action of file retrieval.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:28-44modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-131modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:163-192Requirements
- Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.12.10420.56791).
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:42-43 - The hardcoded AES keys (SysKey and SysKey1) must match those used by the target application.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:14-21
Observed behavior
- Constructs a plaintext ticket containing a filepath, empty username/password, and a far-future timestamp.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-113 - Encrypts the ticket using AES-256-CBC with hardcoded keys and encodes it in a URL-safe Base64 variant.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:125-131 - Sends an HTTP GET request to the /storage/filesvr.dn or /servlets/filesvr.dn endpoint with the forged ticket as a query parameter.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174 - If the response is 200, the file content is returned and stored as loot; the module can also parse the Web.config to extract the machineKey.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:176-192modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:225-251
Behaviors behind the backdoor verdict
Observables
- Hardcoded Key
- Payload withheldHardcoded cryptographic keys extracted from the vulnerable DLL are used to forge access tickets, which is the core of the exploit.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:20-21 - Network Request
- Payload withheldThe module sends a crafted HTTP request to the target to read arbitrary files, which is the intended exploit behavior.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174 - Data Exfiltration
- Payload withheldThe module saves the retrieved file content to the local Metasploit loot directory, which is standard auxiliary module behavior.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:214-222
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; the actual behavior of the included mixins (e.g., gladinet_version, handle_machinekey_extraction) is not expanded in the evidence.
- The review covers only the module source file; Metasploit framework mixins (e.g., Msf::Auxiliary::Gladinet, HttpClient) are not expanded, but the module's own code shows no backdoor behavior.
- Binary files were not inspected, but none are included in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.