HTB DanglingTree Writeup

Machine profile

Platform

Hack The Box

Machine

DanglingTree

Difficulty

Medium

Published

2026-08-13

Status

active

DanglingTree is a medium-difficulty Windows machine from Hack The Box built around Active Directory, and its story is a familiar one: information left in a place it should not have been ends up being the entire attack.

The skill areas are Windows network enumeration, SMB share analysis, credential discovery, Windows administrative tooling, and the Kerberos and LDAP mechanics involved in talking to a domain controller. The later stages are domain-oriented, so readers who are new to Windows will find a clear progression from share enumeration to full domain context.

It suits readers moving from Linux boxes into Windows and Active Directory, and it is a good machine for building the habit of treating every readable file as a possible credential store and every administrative interface as a potential pivot. The techniques it uses — share enumeration, credential discovery, and privileged remote management — are the core of most real-world Windows assessments.

What this machine covers

What the finished writeup contains

When DanglingTree retires, the complete walkthrough publishes here unchanged — every command, output and screenshot from the actual box, in the order it was solved.

1. Reconnaissance Port scanning, service fingerprinting and attack-surface mapping
2. Initial foothold The first authenticated or unauthenticated execution path
3. Enumeration Deeper inspection of the exposed services and their configuration
4. Exploitation Chaining the weaknesses found into a working exploit
5. Credential recovery Secrets, keys and hashes, and how they were obtained
6. Privilege escalation The route from the foothold account to a root shell
7. Flags User and root flag capture