HTB DanglingTree writeup

Active-machine note: DanglingTree is still active on Hack The Box. This is a spoiler-light methodology guide, not a step-by-step solution. Credentials, identities, template names, hashes, payloads, and flags are intentionally omitted.

DanglingTree is a Windows Active Directory machine whose most important lesson is simple: pay attention to the relationships between exposed management services, forgotten application data, and certificate infrastructure. The intended route is not a single exploit. It is a chain of small configuration mistakes.

The complete attack path looked like this:

Anonymous SMB
↓
anderson.w credentials
↓
Windows Admin Center
↓
SmarterMail command execution
↓
svc_mail
↓
SmarterMail password decryption
↓
noah.b
↓
DPAPI / Credential Manager
↓
alex.o
↓
ForceChangePassword
↓
jake.h
↓
Recreate dangling AD CS template
↓
ESC1
↓
Administrator certificate
↓
Kerberos TGT + NT hash
↓
Domain Administrator

1. Map the attack surface

Begin with a complete TCP scan, then run focused service detection against the ports you found.

nmap -Pn -n --min-rate 1000 -T4 -p- TARGET_IP
nmap -Pn -n -sCV --version-all -p<OPEN_PORTS> TARGET_IP

The service mix should make you think “domain controller”: DNS, Kerberos, LDAP, SMB, and the usual RPC ports. Two less-routine observations deserve special attention:

• a browser-accessible Windows management interface on a high port;
• a TLS certificate indicating that Active Directory Certificate Services is present.

Record any clock-skew result too. Kerberos is time-sensitive, so a large difference between your host and the target can make valid authentication look broken later.

sudo ntpdate TARGET_IP

Use that only in your authorized lab and only when you are ready to test Kerberos-dependent tooling.

2. Check SMB before using credentials

Do not assume every share requires authentication. Enumerate anonymously first:

smbclient -N -L //TARGET_IP
smbclient -N //TARGET_IP/<SHARE> -c 'recurse on; ls'

One non-default share exposes an internal assessment document. Read it like an operator: document metadata, scope notes, usernames, service references, and onboarding details can all be useful. The source article obtains an initial account here; the identity and password are redacted in this version.

An important wrinkle is that access changes after authentication. If a share works anonymously but fails with a low-privilege account, do not immediately conclude that the earlier result was a mistake. Compare both security contexts and document the ACL behavior.

3. Treat the management plane as a foothold

The exposed management portal is not just an informational web page. With a valid low-privilege account that has remote-management rights, it can proxy PowerShell operations to the host.

The authentication flow uses an anti-CSRF value, a server-provided public key, an encrypted login packet, and session tokens. Understanding that sequence is more useful than blindly replaying a large script. Inspect the browser’s network traffic and reproduce only the minimum requests needed in your lab.

Once authenticated, use the foothold for quiet local discovery instead of immediately reaching for a reverse shell:

whoami /all
hostname
Get-ChildItem -Force C:\ProgramData
Get-ChildItem -Force 'C:\Program Files (x86)'
Get-Service | Where-Object { $_.Name -match 'mail|admin|cert' }

The directory is deliberately restrictive for the starting user, so host-based enumeration is more productive than repeatedly running broad LDAP collectors.

4. Investigate the mail application and stale data

Local service discovery reveals a mail platform with a management API available from the host. The useful lesson is not a specific copy-paste payload; it is the trust boundary. Ask what the application can fetch, what the service account can read, and whether an administrative operation can be influenced by an authenticated or local caller.

After reaching the mail-service context, inspect the product’s data directories. A retained backup of a mail domain contains old mailbox profiles that are no longer present in the live tree. Forgotten backups often preserve exactly the material administrators thought they had removed.

Get-ChildItem -Force <MAIL_DATA_ROOT>
Get-ChildItem -Recurse -Filter settings.json <MAIL_DATA_ROOT>

One profile stores a password in a reversible encrypted field rather than as a one-way hash. Do not paste the ciphertext into public notes. Instead, locate the application assembly and study the implementation locally:

strings SmarterMail.Standard.dll | grep -iE 'crypto|decrypt|password'
ilspycmd SmarterMail.Standard.dll -o decompiled
grep -RniE 'decrypt|CryptographyHelper' decompiled/

The right workflow is:

1. identify which application method handles the field;
2. confirm the algorithm and key material in the decompiled code;
3. build the smallest local test harness;
4. validate the result without logging or publishing the recovered secret.

This is also the central defensive finding: passwords that must be recoverable by the application are only as safe as the application’s decryption code and key storage.

5. Read the certificate-services clues

With a more useful domain context, enumerate Active Directory Certificate Services. Start with discovery rather than immediately requesting a certificate:

certipy find \
  -u '<DOMAIN_USER>@<DOMAIN>' \
  -p '<REDACTED>' \
  -dc-ip TARGET_IP \
  -enabled -vulnerable

The name DanglingTree points toward a certificate-template relationship that survived after an associated directory object or intended control path changed. Review:

• who can enroll in each enabled template;
• whether the requester can supply a subject or alternative identity;
• authentication-capable extended key usages;
• ownership and write permissions on templates and CA objects;
• stale references between the CA and templates.

Those conditions can combine into an ESC1-style certificate abuse path. Because the machine is active, this guide stops before the exact template, requesting identity, certificate request, PKINIT command, or final credential material.

6. What this machine teaches

DanglingTree rewards disciplined transitions between layers:

• anonymous SMB access can expose high-value operational documents;
• management gateways expand the impact of otherwise limited credentials;
• local application APIs deserve the same scrutiny as internet-facing endpoints;
• stale backups retain users and secrets beyond their intended lifetime;
• reversible password storage turns product reverse engineering into credential recovery;
• certificate-template permissions can convert an ordinary account into domain compromise;
• Kerberos failures may be time problems, not credential problems.

For defenders, remove anonymous share access, audit management-plane exposure, delete or securely archive stale application data, avoid reversible password storage, and review AD CS templates and CA permissions regularly.

Closing note

Use the commands above as checkpoints, not a script. If your observations match the themes here, pause and explain why before moving to the next step. That habit is what turns a completed box into reusable security skill.