DanglingTree - HackTheBox

I just solved DanglingTree from Hack the Box

DanglingTree Machine Summary

DanglingTree is a medium difficulty level Windows machine on Hack the Box

DanglingTree - HackTheBox Season 11 HTB Machine Complete Walkthrough

Protected Page

The first step in owning the DanglingTree machine like I have always done in my previous writeups is to connect my Kali Linux terminal with Hack the Box server. To establish this connection, I ran the following command in the terminal:

Once the connection between my Kali Linux terminal and Hack the Box server has been established, I started the DanglingTree machine and I was assigned an IP address (10.129.26.248).

Nmap Enumeration

I began the enumeration by running an aggressive Nmap scan against the target to identify open ports, running services, and information about the underlying operating system.

I just solved DanglingTree from Hack the Box

The scan revealed several services commonly associated with a Windows Active Directory Domain Controller, including DNS (53), Kerberos (88), LDAP/LDAPS (389/636), SMB (445), Global Catalog LDAP (3268/3269), and RDP (3389). LDAP and RDP enumeration identified the domain as danglingtree.htb, with the target hostname dc.danglingtree.htb and NetBIOS domain DANGLINGTREE. The server also exposed IIS 10.0 over ports 80 and 443, providing an additional web-based attack surface for further enumeration. SMB signing was enabled and required, while the reported clock skew of approximately seven hours was also noteworthy because accurate time synchronization can become important when interacting with Kerberos.

Hosts File Configuration

After identifying the domain and Domain Controller hostname from the Nmap results, I added them to my local /etc/hosts file so they would resolve correctly to the target IP address.

This mapped DC.danglingtree.htb, danglingtree.htb, and the short hostname DC to 10.129.26.248. With local name resolution configured, I could access services using their expected hostnames instead of relying solely on the IP address. This is particularly useful when enumerating Active Directory, Kerberos, LDAP, and hostname-dependent web services.

Web Enumeration

After configuring local name resolution, I visited the target IP address in my browser to investigate the HTTP service discovered on port 80.

The server returned the default Microsoft Internet Information Services (IIS) Windows Server landing page, confirming that IIS was actively serving web content. Since the default page did not expose any immediately useful functionality or application-specific information, I continued with further web enumeration to identify potentially hidden directories, files, or additional endpoints.

SMB Enumeration

I continued the enumeration by using NetExec against the SMB service on port 445 to gather additional information about the target and generate the corresponding hosts file entries.

The results identified the machine as DC within the danglingtree.htb domain, running Windows Build 26100 on a 64-bit architecture. SMB signing was enabled, while SMBv1 was unavailable, reducing the usefulness of several legacy SMB attacks. More importantly, NetExec reported Null Auth:True, indicating that the SMB service accepts unauthenticated connections, making anonymous SMB enumeration a promising next step.

Guest SMB Authentication

Since the previous SMB enumeration indicated that null authentication was permitted, I tested whether the built-in guest account could authenticate without supplying a password.

NetExec successfully authenticated as danglingtree.htb\guest with an empty password, confirming that guest access was enabled on the SMB service. This provided me with valid low-privileged access to the target and opened the possibility of enumerating accessible SMB shares, files, and other domain resources using the guest account.

SMB Share Enumeration

After successfully authenticating as the guest user, I enumerated the available SMB shares to determine which resources were accessible with the current privileges.

The enumeration revealed several standard Windows shares, including ADMIN$, C$, IPC$, NETLOGON, and SYSVOL. While most privileged shares were inaccessible, the guest account had READ permissions on both IPC$ and the custom IT share. The presence of a readable non-standard share named IT was particularly interesting, so I proceeded to inspect its contents for potentially useful files or information.

Accessing the IT SMB Share

After identifying that the IT share was readable, I connected to it using smbclient to manually inspect its contents.

The -N option instructed smbclient not to prompt for a password, allowing me to connect using the available guest/null authentication. The connection succeeded and returned an interactive smb: \> prompt, confirming that I could access the share. From here, I proceeded to enumerate the directories and files stored within the IT share.

SMB Share File Enumeration

Once connected to the IT share, I enumerated its contents and discovered a directory named Security, which appeared particularly relevant to the assessment.

Inside the directory, I found a file named DanglingTree_RoE_Assessment.pdf. Since the guest account had read access, I downloaded the PDF to my local machine using the get command. With the document retrieved successfully, I proceeded to inspect its contents for information that could assist with further enumeration.

Credential Discovery

After downloading the PDF from the IT share, I opened DanglingTree_RoE_Assessment.pdf on my Linux machine and reviewed its contents for information that could assist with further enumeration.

HackTheBox - DanglingTree HTB Season 11 Machine Complete Writeup

While reviewing the document, I discovered a Provided Credentials section containing credentials for the anderson.w account in the danglingtree.htb domain. The document identified this account as a low-privileged standard domain user intended for the security assessment. With a valid domain username and password available, I could now authenticate to exposed services and continue enumerating the Active Directory environment as an authenticated user.

Domain User Authentication

After discovering the anderson.w credentials in the assessment document, I tested them against the SMB service using NetExec to verify whether they were valid.

The authentication attempt succeeded, confirming that anderson.w was a valid user within the danglingtree.htb domain and that the recovered password was correct. This gave me authenticated domain access through SMB with the privileges assigned to the account. With valid credentials confirmed, I proceeded with authenticated enumeration to identify additional resources and potential attack paths.

Authenticated SMB Share Enumeration

After confirming the anderson.w credentials, I enumerated the SMB shares again to determine whether authenticated access exposed additional resources.

Improper authentication in Windows Admin Center

The enumeration showed that anderson.w had READ access to IPC$, NETLOGON, and SYSVOL, while the administrative ADMIN$ and C$ shares remained inaccessible. Compared to the earlier guest access, the account could now read the domain's NETLOGON and SYSVOL shares. Since these shares commonly contain domain scripts, policies, and configuration files, I proceeded to enumerate them for potentially useful information.

SMB User Enumeration

With valid domain credentials, I used NetExec to enumerate users exposed through the SMB service and identify additional accounts within the environment.

The authentication succeeded, but the enumeration returned only the anderson.w account rather than a broader list of domain users. NetExec also revealed that the account's password was last changed on 2026-04-05 and showed no recorded failed password attempts. Since SMB enumeration provided limited user information, I continued exploring other Active Directory services for additional domain data.

RID Brute-Force Enumeration

Since the standard SMB user enumeration returned limited results, I performed RID brute-forcing to enumerate additional users and groups from the domain.

The enumeration successfully resolved multiple RIDs and exposed several domain accounts, including jake.h, svc_mail, noah.b, alex.o, and anderson.w. I also identified several interesting groups such as Cert_Managers, Helpdesk_Cert_Support, Template_Editors, DevOps_PKI, and support-it. These PKI-related groups stood out as potentially important, suggesting that Active Directory Certificate Services (AD CS) could play a role in the attack path.