DanglingTree Writeup - HackTheBox
Created June 15, 2026 • Last updated August 17, 2026 • 10 min read
DanglingTree is a Windows Server 2025 domain controller running a mix of Microsoft and third party management software, with Active Directory Certificate Services in the picture. It is still active, so this page opens with the port scan and stops there.
Reconnaissance
Port scan
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb) 443/tcp open ssl/https? | ssl-cert: Subject: commonName=danglingtree-DC-CA 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap 3268/tcp open ldap 3269/tcp open ssl/globalcatLDAPssl? 3389/tcp open ms-wbt-server 6600/tcp open ssl/https Windows Admin Center 9389/tcp open mc-nmf .NET Message Framing Host script results: |_clock-skew: 6h59m57s
Explain command
| -Pn | Skip host discovery, which the target does not answer. |
| -sC -sV | Run the default script set and probe service versions. |
Domains
Hostnames seen in the scan, from the LDAP certificate SAN and the CA subject:
danglingtree.htbdc.danglingtree.htb
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.