Forked Version (RCE Only)

Forked repository and removed the credential leak part. Applied fixes for compilation.

CVE-2023-27532

Proof of Concept code to exploit CVE-2023-27532 and either leak plaintext credentials or perform remote command execution.

Overview

For a detailed analysis of the vulnerability and exploitation please read the Rapid7 AttackerKB Analysis.

Building

Open in Visual Studio. Since the Liberis Veeam.Backup.Common.dll, Veeam.Backup.Interaction.MountService.dll, and Veeam.Backup.Model.dll are included in the project, they do not need to be concerned about.

Usage

Leak the plaintext credentials from the remote server.

> VeeamHax.exe --target 192.168.0.100

Run an arbitrary command with local system privileges on the remote server.

> VeeamHax.exe --target 192.168.0.100 --cmd calc.exe

Credits

Previous research into this vulnerability was performed by:

• CODE WHITE GmbH
• Huntress
• Y4er