# DanglingTree Writeup - HackTheBox

> Exploit a Windows machine by chaining LDAP enumeration, Kerberoasting, and ACL abuse to escalate privileges and capture the flag.

- **URL:** https://hackindex.io/writeups/danglingtree
- **Platform:** HackTheBox
- **Difficulty:** Medium
- **Operating system:** Windows
- **Machine:** https://app.hackthebox.com/machines/DanglingTree
- **Tags:** authentication-bypass, active-directory, kerberoasting, adcs, acl-abuse, ldap, privilege-escalation, cve-2026-23760
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md), [Khant-Nyar](https://hackindex.io/authors/khant-nyar.md)
- **Read time:** 10 min read
- **Published:** 2026-06-15
- **Updated:** 2026-08-17

DanglingTree is a Windows Server 2025 domain controller running a mix of Microsoft and third party management software, with Active Directory Certificate Services in the picture. It is still active, so this page opens with the port scan and stops there.

## Reconnaissance

### Port scan

```bash
nmap -Pn -sC -sV -p53,80,88,135,139,389,443,445,464,593,636,3268,3269,3389,6600,9389 $TARGET_IP -oA nmap/nmap
# PORT     STATE SERVICE               VERSION
# 53/tcp   open  domain                Simple DNS Plus
# 80/tcp   open  http                  Microsoft IIS httpd 10.0
# 88/tcp   open  kerberos-sec          Microsoft Windows Kerberos
# 135/tcp  open  msrpc                 Microsoft Windows RPC
# 139/tcp  open  netbios-ssn           Microsoft Windows netbios-ssn
# 389/tcp  open  ldap                  Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb)
# 443/tcp  open  ssl/https?
# | ssl-cert: Subject: commonName=danglingtree-DC-CA
# 445/tcp  open  microsoft-ds?
# 464/tcp  open  kpasswd5?
# 593/tcp  open  ncacn_http            Microsoft Windows RPC over HTTP 1.0
# 636/tcp  open  ssl/ldap
# 3268/tcp open  ldap
# 3269/tcp open  ssl/globalcatLDAPssl?
# 3389/tcp open  ms-wbt-server
# 6600/tcp open  ssl/https             Windows Admin Center
# 9389/tcp open  mc-nmf                .NET Message Framing
#
# Host script results:
# |_clock-skew: 6h59m57s
```

### Domains

Hostnames seen in the scan, from the LDAP certificate SAN and the CA subject:

- `danglingtree.htb`
- `dc.danglingtree.htb`

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.