Breaking Bad Backups

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://adversaryco.com/blog/breaking-bad-backups
• Blog Title: Breaking Bad Backups
• Suggested Section: Network Services Pentesting / Pentesting Veeam Backup & Replication, with cross-references from Windows Active Directory credential theft, NTLM relay, DPAPI, and backup-file forensics

🎯 Content Summary

Overview and impact

The post explains how weakly secured enterprise backup infrastructure can become both a path to complete Active Directory compromise and a target for ransomware-driven recovery destruction. Although the examples focus on Veeam Backup & Replication, the underlying attack patterns apply to other backup products: compromise the management server, abuse stored credentials, retrieve sensitive data from exposed backups, and then delete or encrypt recovery points.

A...

🔧 Technical Details

Compromising domain-joined backup servers: A backup server joined to the production Active Directory domain inherits the attack surface of an ordinary domain member. Low-privilege domain access may be escalated through Windows vulnerabilities such as CVE-2025-33073, authentication reflection, relay attacks, or reused local administrator credentials. Administrative or SYSTEM compromise exposes the backup console, configuration database, repositories, and locally decryptable credential store.

Legacy-protocol poisoning and authentication relay: Establish an Adversary-in-the-Middle position and poison legacy broadcast or name-resolution traffic to induce or intercept privileged authentication. Captured challenge-response data can be cracked offline or relayed to SMB and LDAP endpoints that do not enforce signing and channel binding. Backup administrators are particularly valuable targets because their sessions may expose access to management syste...

🤖 Agent Actions

Implemented the HackTricks update.

Changes

• Added src/network-services-pentesting/pentesting-veeam-backup-and-replication.md
  • NetExec Veeam credential extraction
  • Rogue vSphere capture with VeeamThief
  • Unencrypted backup-job abuse
  • Offline VBK extraction
  • VHD/VHDX/VMDK analysis with VHDVomit
  • Recovery-point destruction and technical hardening
• Added the page to SUMMARY.md.
• Added cross-references from DPAPI, NTLM relay, SMB, and Hyper-V/AD disk-extraction pages.
• Included numbered citations to original research, tooling, the blog, and official Veeam documentation.

Validation

• Internal Markdown and mdBook reference paths resolve.
• Citation numbering and banners validated.
• Forbidden sources absent.
• git diff --check passes.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://adversaryco.com/blog/breaking-bad-backups

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting / Pentesting Veeam Backup & Replication, with cross-references from Windows Active Directory credential theft, NTLM relay, DPAPI, and backup-file forensics".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0