Add Gladinet CentreStack/Triofox auxiliary modules and exploit

[Chocapikk]

Hello Metasploit Team,

This PR adds two new auxiliary modules and updates the existing exploit module for Gladinet CentreStack/Triofox vulnerabilities.

Changes

Updated Exploit Module

The gladinet_viewstate_deserialization_cve_2025_30406 exploit module has been updated to accept a MACHINEKEY option.
This change was made in response to new vulnerabilities discovered in Gladinet products (CVE-2025-11371 and related insecure cryptography issues).
These vulnerabilities allow attackers to extract the machineKey from the Web.config file.
The exploit now defaults to the hardcoded vulnerable key but can also use a custom machineKey extracted via the auxiliary modules.

New Auxiliary Modules

1. gladinet_storage_lfi_cve_2025_11371 - Exploits a Local File Inclusion vulnerability in the /storage/t.dn endpoint.
   This module can read arbitrary files from the server's file system.
   It can extract the machineKey from Web.config files and automatically suggests using the exploit module with the extracted key.

2. gladinet_storage_access_ticket_forge - Forges access tickets for the /storage/filesvr.dn endpoint.
   This is done by exploiting hardcoded cryptographic keys in GladCtrl64.dll.
   This module can also read arbitrary files and extract machineKey values.

Shared Mixin

A new mixin Msf::Auxiliary::Gladinet has been created to share common functionality between the auxiliary modules.
The mixin includes:

• machineKey extraction from Web.config files
• Automatic suggestion to use the exploit module with extracted keys
• Common constants and helper methods

Purpose

While these auxiliary modules are designed to work in conjunction with the exploit module (by extracting machineKey values), they are also fully functional standalone modules.
They can be used independently for:

• Reading arbitrary files from vulnerable Gladinet installations
• Extracting sensitive configuration information
• Gathering intelligence about the target system

The modules follow Metasploit coding standards and include comprehensive documentation with real output examples.

Testing

All modules have been tested against:

• Gladinet CentreStack Build 16.1.10296.56315 on Windows Server 2019

The modules pass rubocop, msftidy, and msftidy_docs checks.

[Chocapikk]

@wvu 🫡