How to Recover Account Credentials From the Veeam Backup & Replication Database

SELECT user_name,password,description,change_time_utc FROM [dbo].[Credentials]

Add-Type -AssemblyName 'system.security'
$context = '<encrypted-password-value-from-database>'
$data = [Convert]::FromBase64String($context)
$raw = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
[System.Text.Encoding]::UTF8.GetString($raw)

function Invoke-SQL {
    param(
        $dataSource,
        $sqlQuery = $(throw "Please specify a query."),
        $database
      )
    $connectionString = "Data Source=$dataSource; " + "Integrated Security=SSPI"   
    if ($database.Length -gt 0) { $connectionString + ";Initial Catalog=$database" }
    $connection = new-object system.data.SqlClient.SQLConnection($connectionString)
    $command = new-object system.data.sqlclient.sqlcommand($sqlQuery,$connection)
    $connection.Open()
    $adapter = New-Object System.Data.sqlclient.sqlDataAdapter $command
    $dataset = New-Object System.Data.DataSet
    $adapter.Fill($dataSet) | Out-Null
    $connection.Close()
	return $dataset
}
function DecryptString {
    param(
        [string] $encryptedString
    )  
    [reflection.assembly]::LoadWithPartialName('System.Security') | Out-Null
    $unprotectedBytes = [System.Security.Cryptography.ProtectedData]::Unprotect([System.Convert]::FromBase64String($encryptedString), $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine)
    $string = [System.Text.Encoding]::UTF8.GetString($unprotectedBytes)
    return $string
}

function QueryCredentials {
    param(
        [string] $dataSource,
        [string] $dbName
      )
    
    $query = "SELECT user_name, password, description FROM [dbo].[Credentials]"
    $dataSet = Invoke-SQL $dataSource $query $dbName

    $results = @()
    foreach ($row in $dataSet.Tables[0].Rows) {
        $password = "<not set>"
        if ($row.password -ne "") {
            $password = DecryptString($row.password)
        }
        $results += [pscustomobject]@{login = $row.user_name; password = $password; description = $row.description}
    }

    $results | Format-Table
}

$brKey = Get-ItemProperty "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication"

if ($brKey -eq $null) {
    $sqlKey = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server"
    $installedInstances = $sqlKey.InstalledInstances
    foreach($instance in $installedInstances) {
        $dataSource = "localhost" + "\" + $instance
        $dbName = "sys"
        $query = "select [name] as database_name, database_id, create_date from sys.databases order by name"
        $dataSet = Invoke-SQL $datasource $query
        $databases = @()
        foreach($row in $dataSet.Tables[0].Rows) {
            if ($row.database_name -like "*veeam*") { $databases += $row.database_name }
        }

        foreach($dbName in $databases) {
            QueryCredentials $dataSource $dbName
        }
    }
} else {

    $serverName = $brKey.SqlServerName
    $instanceName = $brKey.SqlInstanceName
    $dbName = $brKey.SqlDatabaseName
    $dataSource = $serverName + "\" + $instanceName

    QueryCredentials $dataSource $dbName

}