Gladinet CentreStack/Triofox Access Ticket Forge

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_gather/gladinet_storage_access_ticket_forge

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit auxiliary module that forges access tickets using hardcoded AES keys to read arbitrary files from vulnerable Gladinet CentreStack/Triofox servers, and can extract the machineKey from Web.config for potential RCE.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit auxiliary module that exploits CVE-2025-14611 to forge access tickets for arbitrary file read. It uses hardcoded AES keys, constructs a plaintext ticket, encrypts it, and sends it to the target. No backdoor, concealed operator-directed harm, or unrelated payload is present. The module's behavior is fully consistent with its documented purpose.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesruby
Target softwareGladinet CentreStackGladinet Triofox
Attack typesarbitrary file readcredential extraction
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively forges cryptographic tickets to read arbitrary files from a remote server, which constitutes exploitation of the hardcoded key vulnerability (CVE-2025-14611). It does not merely detect or scan; it performs the unauthorized action of file retrieval.

modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:28-44modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-131modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:163-192

Requirements

  • Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.12.10420.56791).modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:42-43
  • The hardcoded AES keys (SysKey and SysKey1) must match those used by the target application.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:14-21

Observed behavior

  • Constructs a plaintext ticket containing a filepath, empty username/password, and a far-future timestamp.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-113
  • Encrypts the ticket using AES-256-CBC with hardcoded keys and encodes it in a URL-safe Base64 variant.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:125-131
  • Sends an HTTP GET request to the /storage/filesvr.dn or /servlets/filesvr.dn endpoint with the forged ticket as a query parameter.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174
  • If the response is 200, the file content is returned and stored as loot; the module can also parse the Web.config to extract the machineKey.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:176-192modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:225-251
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Key
DEFAULT_SYS_KEY and DEFAULT_SYS_KEY1Hardcoded cryptographic keys extracted from the vulnerable DLL are used to forge access tickets, which is the core of the exploit.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:20-21
Network Request
GET request to /storage/filesvr.dn or /servlets/filesvr.dn with forged ticket parameterThe module sends a crafted HTTP request to the target to read arbitrary files, which is the intended exploit behavior.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174
Data Exfiltration
File content read from target is stored locally via store_lootThe module saves the retrieved file content to the local Metasploit loot directory, which is standard auxiliary module behavior.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:214-222
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; the actual behavior of the included mixins (e.g., gladinet_version, handle_machinekey_extraction) is not expanded in the evidence.
  • The review covers only the module source file; Metasploit framework mixins (e.g., Msf::Auxiliary::Gladinet, HttpClient) are not expanded, but the module's own code shows no backdoor behavior.
  • Binary files were not inspected, but none are included in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1