Unauthenticated LFI in Gladinet CentreStack and Triofox via Hardcoded AES Cryptographic Values

This repository provides a full proof-of-concept exploit for CVE-2025-14611, a critical vulnerability in Gladinet CentreStack and Triofox (all versions prior to 16.12.10420.56791) on Windows. The vulnerability is due to hardcoded AES-256 keys in the application binary, allowing attackers to forge access tickets and read arbitrary files from the server via the /storage/filesvr.dn HTTP endpoint. The exploit consists of a single Python script (exploit.py) that can both generate (encrypt) and analyze (decrypt) access tickets. The script constructs a malicious ticket by encrypting the target file path (default: web.config), empty username and password (to trigger authentication bypass), and a far-future timestamp (to bypass expiration checks). The resulting ticket is embedded in a URL, which can be used with curl or a browser to retrieve the file from a vulnerable server. The README.md provides extensive technical details, including reverse engineering findings, cryptographic key extraction, and real-world attack scenarios. The exploit enables attackers to obtain sensitive files (such as web.config with machine keys), which can be further leveraged for remote code execution via ViewState deserialization attacks. The repository is operational and provides all necessary components for successful exploitation.