https://wearethebug.dev/tags/cve-2023-27532/Recent content on WE ARE THE BUGTradecraften-usWed, 10 May 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-job2/Wed, 10 May 2023 00:00:00 +0000https://wearethebug.dev/posts/vl-job2/Job2 is a hard-rated Windows machine that involves a macro phishing attack for initial foothold. The machine has hMailServer installed, which includes a configuration file containing encrypted credentials for the database connection. After extracting the password database, we decrypt the SQL Server Compact database file (SDF), allowing a compromised user who can use WinRM to the machine. The machine has a vulnerable version of Veeam Backup & Replication; the attacker executes a malicious executable under sqlserver.exe, which is running as SYSTEM to gain full access.