CVE-2025-30406

This repository contains a functional Proof-of-Concept (PoC) for CVE-2025-30406, a ViewState deserialization vulnerability in ASP.NET applications. The exploit uses ysoserial to generate a malicious payload and includes a custom HTTP server for exfiltrating command output.

This PoC exploits a deserialization vulnerability in Microsoft PowerShell Editor Services, leveraging a crafted serialized payload to achieve remote code execution. The payload includes a malicious resource dictionary with embedded XAML and C# code execution.

This is a detailed writeup explaining CVE-2025-30406, a critical insecure deserialization vulnerability in CentreStack and Triofox due to a hardcoded machineKey. It describes the attack chain, exploitation logic, and mitigation steps.

This Metasploit module exploits a path traversal vulnerability (CVE-2025-11371) in Gladinet CentreStack/Triofox, allowing unauthenticated attackers to read arbitrary files via the `/storage/t.dn` endpoint by manipulating the `s` parameter. It includes functionality to extract the machineKey from Web.config for potential follow-up attacks.

This Metasploit module exploits a ViewState deserialization vulnerability in Gladinet CentreStack/Triofox due to hardcoded machine keys, allowing remote code execution via forged ViewState payloads.