Listen to this Post
Introduction:
In the relentless cat-and-mouse game of cybersecurity, offensive security professionals consistently encounter tools that falter against updated defenses. A prime example is the frequent failure of the popular NetExec (formerly CrackMapExec) Veeam module during penetration tests, often stymied by Anti-Malware Scan Interface (AMSI) or SYSTEM impersonation requirements. This has catalyzed the evolution of more robust alternatives, most notably the SharpVeeamDecryptor tool, which has recently been upgraded to target the latest Veeam Backup & Replication v12 and its PostgreSQL backend, posing a significant new risk to enterprise backup environments.
Learning Objectives:
- Understand the critical vulnerability in Veeam Backup & Replication that allows credential decryption.
- Learn the step-by-step methodology for exploiting Veeam instances using SharpVeeamDecryptor as a fallback when common tools fail.
- Implement definitive hardening measures to protect your backup infrastructure from credential theft and lateral movement.
You Should Know:
1. The Achilles’ Heel: Veeam Credential Storage
Veeam Backup & Replication stores credentials for connecting to backup infrastructure (vSphere, Hyper-V, Windows/Linux servers) in its configuration database. These credentials are encrypted using a static key that is derivable from information stored on the Veeam server itself. This design flaw means any authenticated user (or an attacker who gains sufficient access) can decrypt these highly privileged credentials, leading to catastrophic lateral movement across the entire environment.
Step‑by‑step guide explaining what this does and how to use it.
Prerequisite: You must have access to the Veeam server. This typically begins with compromising a Veeam operator’s workstation, exploiting the Veeam service (e.g., CVE-2022-26500, CVE-2022-26501), or gaining initial access through other means.
Reconnaissance: Identify the Veeam server and its version. On the compromised host, check for running services:
Windows Command: `sc query | findstr Veeam`
PowerShell: `Get-Service Veeam`
Database Identification: Determine if the instance uses the legacy Microsoft SQL Server or the newer PostgreSQL (default in v12).
Check for PostgreSQL processes: `tasklist | findstr postgres`
Look for default installation paths: `C:\Program Files\Veeam\Backup and Replication\Backup\VeeamBackup.mdf` (SQL) or `C:\ProgramData\Veeam\Backup\VeeamBackup` (PostgreSQL config).
2. Exploitation with SharpVeeamDecryptor
SharpVeeamDecryptor is a C tool that automates the extraction and decryption of credentials from both SQL and PostgreSQL Veeam databases. It bypasses common detection vectors that hinder the NetExec module.
Step‑by‑step guide explaining what this does and how to use it.
1. Transfer the Tool: Upload the `SharpVeeamDecryptor.exe` binary to the compromised Veeam server (e.g., via PowerShell web download).
2. Execution for PostgreSQL (Veeam v12): The tool needs to read the database. It may require elevated privileges or impersonation of the `VeeamBackup` user.
SharpVeeamDecryptor.exe --postgres
The tool will automatically locate the PostgreSQL connection parameters from the Veeam configuration files, connect, dump the encrypted credentials, and decrypt them using the derived key.
3. Execution for Microsoft SQL Server: For older instances.
SharpVeeamDecryptor.exe --mssql
4. Output: The tool outputs clear-text credentials in the format:
Username: Domain\Username | Password: PlainTextPassword</code>. These are often domain administrator or virtualization infrastructure credentials. <h2 style="color: yellow;">3. Manual Alternative: Decryption via PS Script</h2> If tool execution is blocked, understanding the manual method is crucial. The core decryption relies on extracting the "VeeamEncryptionKey" from the registry and using it with the .NET cryptography classes. Step‑by‑step guide explaining what this does and how to use it. <h2 style="color: yellow;"> Extract the Key:</h2> [bash] $regPath = "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication" $encKey = (Get-ItemProperty -Path $regPath -Name "VeeamEncryptionKey").VeeamEncryptionKey $keyBytes = [System.Convert]::FromBase64String($encKey)
Query the Database & Decrypt: You would then query the `
.[bash].[bash]` table (SQL) or the `backup.credentials` table (PostgreSQL) to retrieve the `Ciphertext` column for each credential. The decryption routine typically involves AES-256-CBC. Public PoC scripts like `Get-VeeamCredentials.ps1` automate this logic. <h2 style="color: yellow;">4. Lateral Movement & Persistence</h2> The decrypted credentials are your keys to the kingdom. Immediate actions include: Pass-the-Hash/Password: Use the domain admin credentials with tools like NetExec to move laterally. [bash] nxc smb 10.0.1.0/24 -u 'Administrator' -H 'NTLM_HASH' --local-auth
Virtualization Infrastructure Compromise: Log into vCenter or Hyper-V managers with the decrypted infrastructure credentials, potentially gaining control over all virtual machines.
5. Defensive Hardening: Securing the Veeam Server
Mitigation is non-negotiable. Treat your backup server as a Tier-0 asset.
Network Segmentation: Isolate the Veeam backup server and its database in a dedicated network segment, with strict firewall rules limiting inbound connections to specific administrative jump servers.
Credential Management: Move away from built-in credential storage. Implement a Privileged Access Management (PAM) solution like CyberArk or Thycotic, and integrate Veeam with it using the Credential Manager API.
Least Privilege & Audit:
Enforce Multi-Factor Authentication (MFA) for all Veeam console logins.
Ensure the Veeam service accounts have minimal necessary privileges outside of Veeam.
Enable detailed logging and forward logs to a SIEM. Alert on unusual access to the Veeam server or database files.
6. Advanced Detection: Hunting for Threats
Build detections around the key attack sequence.
Process Creation: Alert on the execution of `SharpVeeamDecryptor.exe` or cmd.exe/powershell.exe spawning from the Veeam service process.
Database Access: Monitor for unusual processes (like cmd.exe) accessing the `VeeamBackup` database files (.mdf, .ldf) or connecting to the PostgreSQL port (5432) locally.
Registry Access: Detect processes reading the `VeeamEncryptionKey` registry value outside of normal Veeam operations.
7. Incident Response: If You Suspect Compromise
- Immediate Isolation: Disconnect the Veeam server from the network.
- Credential Rotation: Force a password reset for all credentials stored in Veeam, focusing on domain administrators and virtualization admins first. This must be done from a clean, trusted system.
- Forensic Analysis: Capture memory and disk images of the Veeam server. Look for attacker tools, lateral movement artifacts, and review Veeam job logs for unauthorized configuration changes or data exfiltration attempts.
What Undercode Say:
- Backup Systems Are Primary Targets, Not Safe Havens. The industry mindset must shift: backup infrastructure holds the keys to the entire network and is actively targeted by ransomware groups and advanced attackers. Its security must be commensurate with that of domain controllers.
- Tool Failure Is a Learning Vector. The operational failure of a common tool like the NetExec module is not an obstacle but a critical signal. It indicates evolving defenses and highlights the need for red teams and penetration testers to maintain a deep understanding of underlying principles and alternative exploitation methods, keeping them ahead of automated scanners.
Prediction:
The integration of SharpVeeamDecryptor with support for v12 and PostgreSQL will lower the barrier to entry for exploiting Veeam systems, making this attack a standard step in the ransomware playbook. We predict a significant rise in incidents where compromised backup systems are used not just for data encryption, but for initial credential harvesting that leads to total domain compromise. This will force a market shift towards stricter default configurations for backup software, deeper integration with PAM solutions as a requirement, and potentially the adoption of confidential computing techniques to protect encryption keys even from privileged users on the backup server itself.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Activity 7403784725628166144 - Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
