N1NJ10

Veem

Resources

Commands

  • Technology
    • svc_veeam Account 
      # 1. Define Variables (Change the password to your lab's standard)
$AccountName = "svc_veeam"
$OUName = "Service Accounts"
$DomainPath = (Get-ADDomain).DistinguishedName
$OUPath = "OU=$OUName,$DomainPath"
$Password = ConvertTo-SecureString "Password123#s" -AsPlainText -Force
 
# 2. Create the "Service Accounts" OU (if it doesn't already exist)
if (-not (Get-ADOrganizationalUnit -Filter "Name -eq '$OUName'")) {
    New-ADOrganizationalUnit -Name $OUName -Path $DomainPath
    Write-Host "[+] Created Organizational Unit: $OUName" -ForegroundColor Green
} else {
    Write-Host "[*] Organizational Unit '$OUName' already exists. Skipping." -ForegroundColor Yellow
}
 
# 3. Create the Service Account (Configured for Infrastructure reliability)
# Flags applied: Password Never Expires, User Cannot Change Password
New-ADUser -Name $AccountName `
           -SamAccountName $AccountName `
           -UserPrincipalName "$AccountName@$((Get-ADDomain).Name)" `
           -Path $OUPath `
           -AccountPassword $Password `
           -Enabled $true `
           -PasswordNeverExpires $true `
           -CannotChangePassword $true `
           -Description "Veeam Backup and Replication Service Account"
 
Write-Host "[+] Created Service Account: $AccountName" -ForegroundColor Green
 
# 4. Grant Domain Admin Privileges (Required for VSS / ntds.dit freezing)
Add-ADGroupMember -Identity "Domain Admins" -Members $AccountName
Write-Host "[+] Added $AccountName to the Domain Admins group" -ForegroundColor Green
 
# 5. Set the SPN (The Red Team Trap for Kerberoasting)
# We use the native native Set-ADUser cmdlet instead of the legacy setspn.exe tool
$SPN = "VEEAM/BackupService"
Set-ADUser -Identity $AccountName -ServicePrincipalNames @{Add=$SPN}
 
Write-Host "[+] Registered SPN ($SPN) to enable Kerberoasting practice" -ForegroundColor Green
Write-Host "[SUCCESS] The account is ready to be loaded into the Veeam VBR Console." -ForegroundColor Cyan
  • Offensive
    • Enumeration
      • Version 
        $CoreDllPath = (Get-ItemProperty -Path "HKLM:\Software\Veeam\Veeam Backup and Replication\" | Select-Object -ExpandProperty CorePath) + "Veeam.Backup.Core.dll"; $CoreDll = Get-Item -Path $CoreDllPath; $CoreDll.VersionInfo.ProductVersion + " - " + $CoreDll.VersionInfo.Comments
      • Status 
        Get-Service -Name Veeam* | Select-Object Name, Status
      • Patches 
        Get-ItemProperty -Path "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\AppliedPatches"
      • COmputers 
        Get-ADComputer -Filter "Name -like '*Veeam*' -or Name -like '*Backup*'" | Select-Object Name,DNSHostName
      • Service Accounts 
        Get-ADUser -Filter "servicePrincipalName -like 'Veeam*'" | Select-Object SamAccountName, ServicePrincipalName

Tools

Notes

Graph View

Backlinks