> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/medium/danglingtree.md). # DanglingTree
{% code expandable="true" %} ```bash # Nmap 7.99 scan initiated Sun Aug 9 00:24:15 2026 as: /usr/lib/nmap/nmap --privileged -A -sC -sV -vv -oN nop.txt 10.129.56.58 Nmap scan report for 10.129.56.58 Host is up, received syn-ack ttl 127 (0.13s latency). Scanned at 2026-08-09 00:24:16 EDT for 104s Not shown: 986 filtered tcp ports (no-response) PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0 |_http-title: IIS Windows Server |_http-server-header: Microsoft-IIS/10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-08-09 11:24:32Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE | Issuer: commonName=danglingtree-DC-CA/domainComponent=danglingtree | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-08-03T16:32:53 | Not valid after: 2106-08-03T16:32:53 | MD5: 8267 2fbc 2f8c 4d51 5f85 1b63 bbb3 5a40 | SHA-1: d657 81fd 541a cd7e af8b 1a69 150f 1a29 9336 5f71 | SHA-256: 64ea 2599 3558 b856 1c71 bcde bf7a a71a fdbc b48e f17f c991 d47e 9f2c 8326 1222 | -----BEGIN CERTIFICATE----- | MIIHGTCCBQGgAwIBAgITHgAAAA5tmFJzZxJYSAACAAAADjANBgkqhkiG9w0BAQsF | ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMZGFuZ2xp | bmd0cmVlMRswGQYDVQQDExJkYW5nbGluZ3RyZWUtREMtQ0EwIBcNMjYwODAzMTYz | MjUzWhgPMjEwNjA4MDMxNjMyNTNaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw | ggEKAoIBAQDIFSfKc9nKTCbcoXvqqMSR2JKaHm2wdVOKPHLC0mNjgD5kZ2xh6gyk | yTW6im2DeZozH+jUj/N8dVLGX45Y9gRyoNfJYxgN54n4sjBMeri9UNNO+qb3qcRY | zPhQpC5tCOfzY/gjJysrr1MMFIaqAr4USJnQMNh6spj3jwi4eU7aI5bGIw31JaKK | oi3fC2AGHlkC6/p4JeoddiRmKEKDcvpRlYz27zL/LGjlh8dvvBJtggYD/FqkhVRC | JFYJONlUimD91mfuxxC4EVXgztxgXb8ihjcLCe9ljvvwKm6nTxnvI4UM22OdUNYx | 8gGhu277u6j9pGouvtnLRgrJJJjBtVIVAgMBAAGjggM4MIIDNDA4BgkrBgEEAYI3 | FQcEKzApBiErBgEEAYI3FQiGpuR/h4aIAIWRgQuF84N4hYuqEIEuASECAW4CAQAw | MgYDVR0lBCswKQYIKwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEF | AgMFMA4GA1UdDwEB/wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMC | MAoGCCsGAQUFBwMBMAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQU | k4tSu/hOt7O7lCPAYc+e2rFfpHswHwYDVR0jBBgwFoAUwPV9rSFUxXDPdasEyWV4 | lVeHzRowgdMGA1UdHwSByzCByDCBxaCBwqCBv4aBvGxkYXA6Ly8vQ049ZGFuZ2xp | bmd0cmVlLURDLUNBKDIpLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBT | ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWRhbmdsaW5n | dHJlZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVj | dENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCBuTCB | tgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWRhbmdsaW5ndHJlZS1EQy1DQSxDTj1B | SUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29u | ZmlndXJhdGlvbixEQz1kYW5nbGluZ3RyZWUsREM9aHRiP2NBQ2VydGlmaWNhdGU/ | YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEEGA1UdEQEB | /wQ3MDWCE2RjLmRhbmdsaW5ndHJlZS5odGKCEGRhbmdsaW5ndHJlZS5odGKCDERB | TkdMSU5HVFJFRTBNBgkrBgEEAYI3GQIEQDA+oDwGCisGAQQBgjcZAgGgLgQsUy0x | LTUtMjEtNDIyMDIzODMzMi01NzAyMzcyOC0xMTI5MTEwNjQ2LTEwMDAwDQYJKoZI | hvcNAQELBQADggIBAAHAz84BKh0DGMV9YEg2L/ddBbp5GTj1R5xSmOt9nFGb4UDO | 96HOFHq1rnlFswd9oEAz+gG4bIt6CiLQ+/EFEf1O8cBiDTAsS3F16ffF+dvdRwCM | oU7RBx2Tc3gQOLRFysfZ5QabG189CcneKoz9qTt7nWfX5Zj/xeR8Vn3aDv0J9h72 | DVu67Prh9QR85dur8aq62G4BdpnhpleWkIrVTahvZvk+ZdQ6mo98lMDVt13ILX/o | jJ8nTE5Pe1JMqyjnjPn++1JSqDLUbxvXPWaQZbnc3NZRGWWC6DfaaiIqTTAFSk68 | bfYHNu8PDPGWgeNhzYSSCNbeHVfx/qp474ITfIwMY2DxJBcbXLFFKgFsawKi7Aza | bsFq16tMSTcQjRrJaXaB9yDKry57lwtGAlRJaVzQXZ4lW49eYcwJC5fHIOAftCZ/ | 0VYS8H7TR9+2e2m/UY83JX965+fmVbh5VfFPhKgow5clTLDE2cJ2i1RLMwaRCHSn | kWYFWuhlBHD3YGNMlXILXF32w2WbeJCLGIQV8o8KUTbKOBRoAwaV35bsECanZ+sI | l1m1fqiq7Bruu+ftv7dP9dOHW0ZFnXeMWW4UAo/JGdY0AlHd/P3quZkEQv+OP3IT | wbON87Eu+ImljefcU5kALJZCGWIBpNBowe490QkpoLwPiG9WXqgWkf/JBMYy |_-----END CERTIFICATE----- 443/tcp open ssl/https? syn-ack ttl 127 |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=danglingtree-DC-CA/domainComponent=danglingtree | Issuer: commonName=danglingtree-DC-CA/domainComponent=danglingtree | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-03-26T05:34:19 | Not valid after: 2114-03-26T05:44:18 | MD5: 9054 595f c5e0 bb67 628f f4fc 8d82 a8cf | SHA-1: 9733 440c 1fd9 f7c9 db9e d4e8 69b7 7b8e 8e71 7781 | SHA-256: fb01 7a29 c4a9 3bee db84 2c1d 77e4 6cd3 d00b 89d8 8229 a712 c4ca db44 3678 29a0 | -----BEGIN CERTIFICATE----- | MIIFfTCCA2WgAwIBAgIQYN9cBM7vHJBM3yjtuX75JTANBgkqhkiG9w0BAQsFADBQ | MRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMZGFuZ2xpbmd0 | cmVlMRswGQYDVQQDExJkYW5nbGluZ3RyZWUtREMtQ0EwIBcNMjYwMzI2MDUzNDE5 | WhgPMjExNDAzMjYwNTQ0MThaMFAxEzARBgoJkiaJk/IsZAEZFgNodGIxHDAaBgoJ | kiaJk/IsZAEZFgxkYW5nbGluZ3RyZWUxGzAZBgNVBAMTEmRhbmdsaW5ndHJlZS1E | Qy1DQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMJ9plR3FhO4uCPr | KwPVczpDESlGUS0RXjy8gITNqdO3VBNi63XOAjn9FjbBw3VGWQvxUoZfX4/RfS9B | PnHu1y92fnYYYU7ZPOCtvY99/exopF7BZa4ewQtrL5ZhUP4qTw17ZYknZ82a9fca | k1AhF0w7oTcEW38TnsSUZRthgcHLfk7EN+bm2z5lm23eTNBftiEiUdtY3hz4QofW | AtTGoRAatWVxHbwFFdbHiNPJNB6CF1zRYY96mhxrFb38uRI59sn8XNNlU79vVwQo | Cw5f5IS0RTd7uOXt03w3mbESatPaLn3sOey8k/U80PjiOyQZmj/9GrwCqrUWWyan | z2NjEEQepjlHc9mAyfnbmPo4Qcf2LohY0DiJZaEfcnyXaTbEGvJv+VRp86KZ6+Im | E1CP+sflfd1aKk5urs5gkXHDs15oYP7LGAtr4uJbjPOxinGc3UEVdAS91myB1zCX | iZOFigZIFu3tEOWRwS1GGseoS+LgTLnFaoo1ck1ylkxT18ud/W+Knn2oU/BmsxjM | cdmMDCr+J6rwA2rHmgQaP4wUOkbPkc7xdjOiQyk+WIsSX53VJqUmkfjrl1Td0zRM | +vekyNRGaCpvGQidafmwP7acA74XJ8+vD/NyMvBpHyktswXXh0tlotmZhBtEnueN | Lbo09H2InBKZ6DNQx9D3a7jBds89AgMBAAGjUTBPMAsGA1UdDwQEAwIBhjAPBgNV | HRMBAf8EBTADAQH/MB0GA1UdDgQWBBSC4b8HPDULHkkU0zHggJopP00e9TAQBgkr | BgEEAYI3FQEEAwIBADANBgkqhkiG9w0BAQsFAAOCAgEAq/8Xg7bG3KX/WDKUl9ff | XMAsjh3wkta3X6sWCKeqshEb1yz9T+N9NSUEul0HaJlvSErMvQqVDQyOs9k2rgzw | 3hL4EJaeyYIln+9itkkdIQecfbTwPPxqDeJAFaOqDv5JZ7ypo3Lr5AflvC9U+4+4 | SGfqr8PVhoSktFgDp9VP4cZfoi6EhTvxHJ/ZMeHVv6Ky6QtzCdeH1fs/aEGQ71D3 | Tc/Mwacf1A3YQCVDp9B3MQ6jbNOoE3qaGuRHvK0tjkFfKR72CrA0GYe4E9gyqPmo | T6IJhcV4JfozTbya1R3A2pSdpt2Skxh7vxQQ1uAUp/iZ5ThhzaG+PIwYmfl05Daq | aPhm5hE3clCdoMZHjcfIf+5sw+W8LqNUxaIxNVuK61Oh1H4QKMkhTPNTX80Nz99N | L+4JrWnD5mV33FhpZXbbZdzDsCGgqrLiNAufceyWsrRAgfOIq12UL1VhaY9CLXKT | YJ4jmKrnmwd29oeHvZTXWosXCgOoU0pPPuFwxqDVxd9ctiC/xMnTRf4o6D+SvApR | KoubwtRGV0pqjbvEVcTwYb2oxL9uIa9ecQeHfWzKFiqdyYBrQw+M/dH8z/wqo76q | bDxec0o/QfgPZSzVKh9u9AGV8fKmG0aqhdh4iWn8GUBQTsiBeCdL1E1RT55lN4k/ | THnYKHaL8sIUizOeG6eZHbY= |_-----END CERTIFICATE----- | tls-alpn: | h2 |_ http/1.1 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE | Issuer: commonName=danglingtree-DC-CA/domainComponent=danglingtree | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-08-03T16:32:53 | Not valid after: 2106-08-03T16:32:53 | MD5: 8267 2fbc 2f8c 4d51 5f85 1b63 bbb3 5a40 | SHA-1: d657 81fd 541a cd7e af8b 1a69 150f 1a29 9336 5f71 | SHA-256: 64ea 2599 3558 b856 1c71 bcde bf7a a71a fdbc b48e f17f c991 d47e 9f2c 8326 1222 | -----BEGIN CERTIFICATE----- | MIIHGTCCBQGgAwIBAgITHgAAAA5tmFJzZxJYSAACAAAADjANBgkqhkiG9w0BAQsF | ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMZGFuZ2xp | bmd0cmVlMRswGQYDVQQDExJkYW5nbGluZ3RyZWUtREMtQ0EwIBcNMjYwODAzMTYz | MjUzWhgPMjEwNjA4MDMxNjMyNTNaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw | ggEKAoIBAQDIFSfKc9nKTCbcoXvqqMSR2JKaHm2wdVOKPHLC0mNjgD5kZ2xh6gyk | yTW6im2DeZozH+jUj/N8dVLGX45Y9gRyoNfJYxgN54n4sjBMeri9UNNO+qb3qcRY | zPhQpC5tCOfzY/gjJysrr1MMFIaqAr4USJnQMNh6spj3jwi4eU7aI5bGIw31JaKK | oi3fC2AGHlkC6/p4JeoddiRmKEKDcvpRlYz27zL/LGjlh8dvvBJtggYD/FqkhVRC | JFYJONlUimD91mfuxxC4EVXgztxgXb8ihjcLCe9ljvvwKm6nTxnvI4UM22OdUNYx | 8gGhu277u6j9pGouvtnLRgrJJJjBtVIVAgMBAAGjggM4MIIDNDA4BgkrBgEEAYI3 | FQcEKzApBiErBgEEAYI3FQiGpuR/h4aIAIWRgQuF84N4hYuqEIEuASECAW4CAQAw | MgYDVR0lBCswKQYIKwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEF | AgMFMA4GA1UdDwEB/wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMC | MAoGCCsGAQUFBwMBMAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQU | k4tSu/hOt7O7lCPAYc+e2rFfpHswHwYDVR0jBBgwFoAUwPV9rSFUxXDPdasEyWV4 | lVeHzRowgdMGA1UdHwSByzCByDCBxaCBwqCBv4aBvGxkYXA6Ly8vQ049ZGFuZ2xp | bmd0cmVlLURDLUNBKDIpLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBT | ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWRhbmdsaW5n | dHJlZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVj | dENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCBuTCB | tgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWRhbmdsaW5ndHJlZS1EQy1DQSxDTj1B | SUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29u | ZmlndXJhdGlvbixEQz1kYW5nbGluZ3RyZWUsREM9aHRiP2NBQ2VydGlmaWNhdGU/ | YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEEGA1UdEQEB | /wQ3MDWCE2RjLmRhbmdsaW5ndHJlZS5odGKCEGRhbmdsaW5ndHJlZS5odGKCDERB | TkdMSU5HVFJFRTBNBgkrBgEEAYI3GQIEQDA+oDwGCisGAQQBgjcZAgGgLgQsUy0x | LTUtMjEtNDIyMDIzODMzMi01NzAyMzcyOC0xMTI5MTEwNjQ2LTEwMDAwDQYJKoZI | hvcNAQELBQADggIBAAHAz84BKh0DGMV9YEg2L/ddBbp5GTj1R5xSmOt9nFGb4UDO | 96HOFHq1rnlFswd9oEAz+gG4bIt6CiLQ+/EFEf1O8cBiDTAsS3F16ffF+dvdRwCM | oU7RBx2Tc3gQOLRFysfZ5QabG189CcneKoz9qTt7nWfX5Zj/xeR8Vn3aDv0J9h72 | DVu67Prh9QR85dur8aq62G4BdpnhpleWkIrVTahvZvk+ZdQ6mo98lMDVt13ILX/o | jJ8nTE5Pe1JMqyjnjPn++1JSqDLUbxvXPWaQZbnc3NZRGWWC6DfaaiIqTTAFSk68 | bfYHNu8PDPGWgeNhzYSSCNbeHVfx/qp474ITfIwMY2DxJBcbXLFFKgFsawKi7Aza | bsFq16tMSTcQjRrJaXaB9yDKry57lwtGAlRJaVzQXZ4lW49eYcwJC5fHIOAftCZ/ | 0VYS8H7TR9+2e2m/UY83JX965+fmVbh5VfFPhKgow5clTLDE2cJ2i1RLMwaRCHSn | kWYFWuhlBHD3YGNMlXILXF32w2WbeJCLGIQV8o8KUTbKOBRoAwaV35bsECanZ+sI | l1m1fqiq7Bruu+ftv7dP9dOHW0ZFnXeMWW4UAo/JGdY0AlHd/P3quZkEQv+OP3IT | wbON87Eu+ImljefcU5kALJZCGWIBpNBowe490QkpoLwPiG9WXqgWkf/JBMYy |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE | Issuer: commonName=danglingtree-DC-CA/domainComponent=danglingtree | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-08-03T16:32:53 | Not valid after: 2106-08-03T16:32:53 | MD5: 8267 2fbc 2f8c 4d51 5f85 1b63 bbb3 5a40 | SHA-1: d657 81fd 541a cd7e af8b 1a69 150f 1a29 9336 5f71 | SHA-256: 64ea 2599 3558 b856 1c71 bcde bf7a a71a fdbc b48e f17f c991 d47e 9f2c 8326 1222 | -----BEGIN CERTIFICATE----- | MIIHGTCCBQGgAwIBAgITHgAAAA5tmFJzZxJYSAACAAAADjANBgkqhkiG9w0BAQsF | ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMZGFuZ2xp | bmd0cmVlMRswGQYDVQQDExJkYW5nbGluZ3RyZWUtREMtQ0EwIBcNMjYwODAzMTYz | MjUzWhgPMjEwNjA4MDMxNjMyNTNaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw | ggEKAoIBAQDIFSfKc9nKTCbcoXvqqMSR2JKaHm2wdVOKPHLC0mNjgD5kZ2xh6gyk | yTW6im2DeZozH+jUj/N8dVLGX45Y9gRyoNfJYxgN54n4sjBMeri9UNNO+qb3qcRY | zPhQpC5tCOfzY/gjJysrr1MMFIaqAr4USJnQMNh6spj3jwi4eU7aI5bGIw31JaKK | oi3fC2AGHlkC6/p4JeoddiRmKEKDcvpRlYz27zL/LGjlh8dvvBJtggYD/FqkhVRC | JFYJONlUimD91mfuxxC4EVXgztxgXb8ihjcLCe9ljvvwKm6nTxnvI4UM22OdUNYx | 8gGhu277u6j9pGouvtnLRgrJJJjBtVIVAgMBAAGjggM4MIIDNDA4BgkrBgEEAYI3 | FQcEKzApBiErBgEEAYI3FQiGpuR/h4aIAIWRgQuF84N4hYuqEIEuASECAW4CAQAw | MgYDVR0lBCswKQYIKwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEF | AgMFMA4GA1UdDwEB/wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMC | MAoGCCsGAQUFBwMBMAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQU | k4tSu/hOt7O7lCPAYc+e2rFfpHswHwYDVR0jBBgwFoAUwPV9rSFUxXDPdasEyWV4 | lVeHzRowgdMGA1UdHwSByzCByDCBxaCBwqCBv4aBvGxkYXA6Ly8vQ049ZGFuZ2xp | bmd0cmVlLURDLUNBKDIpLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBT | ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWRhbmdsaW5n | dHJlZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVj | dENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCBuTCB | tgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWRhbmdsaW5ndHJlZS1EQy1DQSxDTj1B | SUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29u | ZmlndXJhdGlvbixEQz1kYW5nbGluZ3RyZWUsREM9aHRiP2NBQ2VydGlmaWNhdGU/ | YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEEGA1UdEQEB | /wQ3MDWCE2RjLmRhbmdsaW5ndHJlZS5odGKCEGRhbmdsaW5ndHJlZS5odGKCDERB | TkdMSU5HVFJFRTBNBgkrBgEEAYI3GQIEQDA+oDwGCisGAQQBgjcZAgGgLgQsUy0x | LTUtMjEtNDIyMDIzODMzMi01NzAyMzcyOC0xMTI5MTEwNjQ2LTEwMDAwDQYJKoZI | hvcNAQELBQADggIBAAHAz84BKh0DGMV9YEg2L/ddBbp5GTj1R5xSmOt9nFGb4UDO | 96HOFHq1rnlFswd9oEAz+gG4bIt6CiLQ+/EFEf1O8cBiDTAsS3F16ffF+dvdRwCM | oU7RBx2Tc3gQOLRFysfZ5QabG189CcneKoz9qTt7nWfX5Zj/xeR8Vn3aDv0J9h72 | DVu67Prh9QR85dur8aq62G4BdpnhpleWkIrVTahvZvk+ZdQ6mo98lMDVt13ILX/o | jJ8nTE5Pe1JMqyjnjPn++1JSqDLUbxvXPWaQZbnc3NZRGWWC6DfaaiIqTTAFSk68 | bfYHNu8PDPGWgeNhzYSSCNbeHVfx/qp474ITfIwMY2DxJBcbXLFFKgFsawKi7Aza | bsFq16tMSTcQjRrJaXaB9yDKry57lwtGAlRJaVzQXZ4lW49eYcwJC5fHIOAftCZ/ | 0VYS8H7TR9+2e2m/UY83JX965+fmVbh5VfFPhKgow5clTLDE2cJ2i1RLMwaRCHSn | kWYFWuhlBHD3YGNMlXILXF32w2WbeJCLGIQV8o8KUTbKOBRoAwaV35bsECanZ+sI | l1m1fqiq7Bruu+ftv7dP9dOHW0ZFnXeMWW4UAo/JGdY0AlHd/P3quZkEQv+OP3IT | wbON87Eu+ImljefcU5kALJZCGWIBpNBowe490QkpoLwPiG9WXqgWkf/JBMYy |_-----END CERTIFICATE----- 3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: danglingtree.htb, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.danglingtree.htb, DNS:danglingtree.htb, DNS:DANGLINGTREE | Issuer: commonName=danglingtree-DC-CA/domainComponent=danglingtree | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-08-03T16:32:53 | Not valid after: 2106-08-03T16:32:53 | MD5: 8267 2fbc 2f8c 4d51 5f85 1b63 bbb3 5a40 | SHA-1: d657 81fd 541a cd7e af8b 1a69 150f 1a29 9336 5f71 | SHA-256: 64ea 2599 3558 b856 1c71 bcde bf7a a71a fdbc b48e f17f c991 d47e 9f2c 8326 1222 | -----BEGIN CERTIFICATE----- | MIIHGTCCBQGgAwIBAgITHgAAAA5tmFJzZxJYSAACAAAADjANBgkqhkiG9w0BAQsF | ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRwwGgYKCZImiZPyLGQBGRYMZGFuZ2xp | bmd0cmVlMRswGQYDVQQDExJkYW5nbGluZ3RyZWUtREMtQ0EwIBcNMjYwODAzMTYz | MjUzWhgPMjEwNjA4MDMxNjMyNTNaMAAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw | ggEKAoIBAQDIFSfKc9nKTCbcoXvqqMSR2JKaHm2wdVOKPHLC0mNjgD5kZ2xh6gyk | yTW6im2DeZozH+jUj/N8dVLGX45Y9gRyoNfJYxgN54n4sjBMeri9UNNO+qb3qcRY | zPhQpC5tCOfzY/gjJysrr1MMFIaqAr4USJnQMNh6spj3jwi4eU7aI5bGIw31JaKK | oi3fC2AGHlkC6/p4JeoddiRmKEKDcvpRlYz27zL/LGjlh8dvvBJtggYD/FqkhVRC | JFYJONlUimD91mfuxxC4EVXgztxgXb8ihjcLCe9ljvvwKm6nTxnvI4UM22OdUNYx | 8gGhu277u6j9pGouvtnLRgrJJJjBtVIVAgMBAAGjggM4MIIDNDA4BgkrBgEEAYI3 | FQcEKzApBiErBgEEAYI3FQiGpuR/h4aIAIWRgQuF84N4hYuqEIEuASECAW4CAQAw | MgYDVR0lBCswKQYIKwYBBQUHAwIGCCsGAQUFBwMBBgorBgEEAYI3FAICBgcrBgEF | AgMFMA4GA1UdDwEB/wQEAwIFoDBABgkrBgEEAYI3FQoEMzAxMAoGCCsGAQUFBwMC | MAoGCCsGAQUFBwMBMAwGCisGAQQBgjcUAgIwCQYHKwYBBQIDBTAdBgNVHQ4EFgQU | k4tSu/hOt7O7lCPAYc+e2rFfpHswHwYDVR0jBBgwFoAUwPV9rSFUxXDPdasEyWV4 | lVeHzRowgdMGA1UdHwSByzCByDCBxaCBwqCBv4aBvGxkYXA6Ly8vQ049ZGFuZ2xp | bmd0cmVlLURDLUNBKDIpLENOPWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBT | ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWRhbmdsaW5n | dHJlZSxEQz1odGI/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVj | dENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHJBggrBgEFBQcBAQSBvDCBuTCB | tgYIKwYBBQUHMAKGgalsZGFwOi8vL0NOPWRhbmdsaW5ndHJlZS1EQy1DQSxDTj1B | SUEsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29u | ZmlndXJhdGlvbixEQz1kYW5nbGluZ3RyZWUsREM9aHRiP2NBQ2VydGlmaWNhdGU/ | YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MEEGA1UdEQEB | /wQ3MDWCE2RjLmRhbmdsaW5ndHJlZS5odGKCEGRhbmdsaW5ndHJlZS5odGKCDERB | TkdMSU5HVFJFRTBNBgkrBgEEAYI3GQIEQDA+oDwGCisGAQQBgjcZAgGgLgQsUy0x | LTUtMjEtNDIyMDIzODMzMi01NzAyMzcyOC0xMTI5MTEwNjQ2LTEwMDAwDQYJKoZI | hvcNAQELBQADggIBAAHAz84BKh0DGMV9YEg2L/ddBbp5GTj1R5xSmOt9nFGb4UDO | 96HOFHq1rnlFswd9oEAz+gG4bIt6CiLQ+/EFEf1O8cBiDTAsS3F16ffF+dvdRwCM | oU7RBx2Tc3gQOLRFysfZ5QabG189CcneKoz9qTt7nWfX5Zj/xeR8Vn3aDv0J9h72 | DVu67Prh9QR85dur8aq62G4BdpnhpleWkIrVTahvZvk+ZdQ6mo98lMDVt13ILX/o | jJ8nTE5Pe1JMqyjnjPn++1JSqDLUbxvXPWaQZbnc3NZRGWWC6DfaaiIqTTAFSk68 | bfYHNu8PDPGWgeNhzYSSCNbeHVfx/qp474ITfIwMY2DxJBcbXLFFKgFsawKi7Aza | bsFq16tMSTcQjRrJaXaB9yDKry57lwtGAlRJaVzQXZ4lW49eYcwJC5fHIOAftCZ/ | 0VYS8H7TR9+2e2m/UY83JX965+fmVbh5VfFPhKgow5clTLDE2cJ2i1RLMwaRCHSn | kWYFWuhlBHD3YGNMlXILXF32w2WbeJCLGIQV8o8KUTbKOBRoAwaV35bsECanZ+sI | l1m1fqiq7Bruu+ftv7dP9dOHW0ZFnXeMWW4UAo/JGdY0AlHd/P3quZkEQv+OP3IT | wbON87Eu+ImljefcU5kALJZCGWIBpNBowe490QkpoLwPiG9WXqgWkf/JBMYy |_-----END CERTIFICATE----- 3389/tcp open ms-wbt-server syn-ack ttl 127 | ssl-cert: Subject: commonName=dc.danglingtree.htb | Issuer: commonName=dc.danglingtree.htb | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-03-25T05:48:29 | Not valid after: 2026-09-24T05:48:29 | MD5: 4599 496f 7b7e 5e3a 060b b62f 49a6 0f04 | SHA-1: c841 e9c4 c71c 273c 11ae 36e3 6a6e 80d5 44f5 695c | SHA-256: 2f56 67eb 1671 b5ad e87f 4c92 4480 2d42 1149 08c4 488e 8b22 954c 5cc3 2da3 9017 | -----BEGIN CERTIFICATE----- | MIIC6jCCAdKgAwIBAgIQEVbFS9jYO4hAnZHZVOnxNzANBgkqhkiG9w0BAQsFADAe | MRwwGgYDVQQDExNkYy5kYW5nbGluZ3RyZWUuaHRiMB4XDTI2MDMyNTA1NDgyOVoX | DTI2MDkyNDA1NDgyOVowHjEcMBoGA1UEAxMTZGMuZGFuZ2xpbmd0cmVlLmh0YjCC | ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMpljSbPqpWEDi6pIv/CJk5g | f7K9zUJqpjSwY5xd+E8yor06tjZRAKdYbRrEnfpAg7k77lxNaFgByW9BZxz3rtTl | w16mcdQKgFAQh9z2HxQ/QaP5Xc4edNpNqy2o5e5X7rOY4iHYj5csZpV+PetuPCxs | I8hUaSjPEWmSAFrFejOR/LgUS0l/4LNE3ixwwnyOSg0BqHEQxv8of2VMG6zgf8a3 | mSDhBVmmhKCXgiOb5DyiE721w9LLxUcUygA+vw33p2SfdDRsbApSV+xFWp2OzN6i | Jlk6ZCBR7oVo5nEjGIDmW17C689SIrFZpUW/OxuXX6I95s4maePjqN+Mp6mFW70C | AwEAAaMkMCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQwMA0GCSqG | SIb3DQEBCwUAA4IBAQCRt0ETKSz46BuctLcwG1I6YsmDHB6hD4efSjzUZF6/a1wG | LewqqsV02wr7H/u6z2dQdIw8m01SqV/zu5tByMIFocBmxitLrlSqVq+d/9uzHfFT | XK6E5kPDjDEI0X6a5W0IWY5XXqqhASGvBr0ERcMU16WNeCYk4KWnNmA10XYY6F98 | qYCXsgsILJfL5t8DwLQyx2v8sHGiFYsy2Y8/4KMgPqKCk2b8YY6ziWBHjZ0ystWA | 1C2wWJnogbHugS1amE0l2OTuw3RwYWX6LBaOvSKyoMKWG/hcJBY0IORlevjC53/X | Tl5DYgm8JDDoW04DbrY9VXGDxNmiNeymhE9jVj8M |_-----END CERTIFICATE----- | rdp-ntlm-info: | Target_Name: DANGLINGTREE | NetBIOS_Domain_Name: DANGLINGTREE | NetBIOS_Computer_Name: DC | DNS_Domain_Name: danglingtree.htb | DNS_Computer_Name: dc.danglingtree.htb | DNS_Tree_Name: danglingtree.htb | Product_Version: 10.0.26100 |_ System_Time: 2026-08-09T11:25:19+00:00 |_ssl-date: TLS randomness does not represent time 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port3389-TCP:V=7.99%I=7%D=8/9%Time=6A780103%P=x86_64-pc-linux-gnu%r(Ter SF:minalServerCookie,13,"\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02\?\x08\0\x02\0 SF:\0\0"); Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2012|2016 (88%) OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016 OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2022 (88%), Microsoft Windows 11 24H2 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.99%E=4%D=8/9%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=6A780158%P=x86_64-pc-linux-gnu) SEQ(SP=100%GCD=1%ISR=10E%TI=I%II=I%SS=S%TS=A) SEQ(SP=105%GCD=1%ISR=10A%TI=I%II=I%SS=S%TS=A) OPS(O1=M552NW8ST11%O2=M552NW8ST11%O3=M552NW8NNT11%O4=M552NW8ST11%O5=M552NW8ST11%O6=M552ST11) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFFF) ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=N) U1(R=N) IE(R=Y%DFI=N%TG=80%CD=Z) Uptime guess: 0.032 days (since Sat Aug 8 23:40:38 2026) Network Distance: 2 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 55778/tcp): CLEAN (Timeout) | Check 2 (port 26653/tcp): CLEAN (Timeout) | Check 3 (port 48294/udp): CLEAN (Timeout) | Check 4 (port 24539/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2026-08-09T11:25:22 |_ start_date: N/A |_clock-skew: mean: 7h00m00s, deviation: 0s, median: 7h00m00s TRACEROUTE (using port 443/tcp) HOP RTT ADDRESS 1 132.41 ms 10.10.14.1 2 132.47 ms 10.129.56.58 Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sun Aug 9 00:26:00 2026 -- 1 IP address (1 host up) scanned in 104.28 seconds ``` {% endcode %} {% code expandable="true" %} ```bash ┌──(kali㉿kali)-[~/Eth3real/htb/DanglingTree] └─$ smbclient //danglingtree.htb/IT -N Try "help" to get a list of possible commands. smb: \> ls . D 0 Sat Apr 4 21:05:09 2026 .. D 0 Sat Apr 4 20:57:30 2026 Security D 0 Sat Apr 4 21:05:20 2026 7062015 blocks of size 4096. 2199290 blocks available smb: \> cd Security\ smb: \Security\> ls . D 0 Sat Apr 4 21:05:20 2026 .. D 0 Sat Apr 4 21:05:09 2026 DanglingTree_RoE_Assessment.pdf A 28905 Sat Apr 4 11:50:23 2026 7062015 blocks of size 4096. 2199282 blocks available smb: \Security\> get DanglingTree_RoE_Assessment.pdf getting file \Security\DanglingTree_RoE_Assessment.pdf of size 28905 as DanglingTree_RoE_Assessment.pdf (18.3 KiloBytes/sec) (average 18.3 KiloBytes/sec) smb: \Security\> exit ``` {% endcode %}
`anderson.w / R3dT3am@Acc3ss#01` {% code expandable="true" %} ``` ┌──(kali㉿kali)-[~/Eth3real/htb/DanglingTree] └─$ nxc smb 10.129.56.58 -u anderson.w -p 'R3dT3am@Acc3ss#01' --rid-brute SMB 10.129.56.58 445 DC [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC) (domain:danglingtree.htb) (signing:True) (SMBv1:False) (Null Auth:True) SMB 10.129.56.58 445 DC [+] danglingtree.htb\anderson.w:R3dT3am@Acc3ss#01 SMB 10.129.56.58 445 DC 498: DANGLINGTREE\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.129.56.58 445 DC 500: DANGLINGTREE\Administrator (SidTypeUser) SMB 10.129.56.58 445 DC 501: DANGLINGTREE\Guest (SidTypeUser) SMB 10.129.56.58 445 DC 502: DANGLINGTREE\krbtgt (SidTypeUser) SMB 10.129.56.58 445 DC 512: DANGLINGTREE\Domain Admins (SidTypeGroup) SMB 10.129.56.58 445 DC 513: DANGLINGTREE\Domain Users (SidTypeGroup) SMB 10.129.56.58 445 DC 514: DANGLINGTREE\Domain Guests (SidTypeGroup) SMB 10.129.56.58 445 DC 515: DANGLINGTREE\Domain Computers (SidTypeGroup) SMB 10.129.56.58 445 DC 516: DANGLINGTREE\Domain Controllers (SidTypeGroup) SMB 10.129.56.58 445 DC 517: DANGLINGTREE\Cert Publishers (SidTypeAlias) SMB 10.129.56.58 445 DC 518: DANGLINGTREE\Schema Admins (SidTypeGroup) SMB 10.129.56.58 445 DC 519: DANGLINGTREE\Enterprise Admins (SidTypeGroup) SMB 10.129.56.58 445 DC 520: DANGLINGTREE\Group Policy Creator Owners (SidTypeGroup) SMB 10.129.56.58 445 DC 521: DANGLINGTREE\Read-only Domain Controllers (SidTypeGroup) SMB 10.129.56.58 445 DC 522: DANGLINGTREE\Cloneable Domain Controllers (SidTypeGroup) SMB 10.129.56.58 445 DC 525: DANGLINGTREE\Protected Users (SidTypeGroup) SMB 10.129.56.58 445 DC 526: DANGLINGTREE\Key Admins (SidTypeGroup) SMB 10.129.56.58 445 DC 527: DANGLINGTREE\Enterprise Key Admins (SidTypeGroup) SMB 10.129.56.58 445 DC 528: DANGLINGTREE\Forest Trust Accounts (SidTypeGroup) SMB 10.129.56.58 445 DC 529: DANGLINGTREE\External Trust Accounts (SidTypeGroup) SMB 10.129.56.58 445 DC 553: DANGLINGTREE\RAS and IAS Servers (SidTypeAlias) SMB 10.129.56.58 445 DC 571: DANGLINGTREE\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.129.56.58 445 DC 572: DANGLINGTREE\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.129.56.58 445 DC 1000: DANGLINGTREE\DC$ (SidTypeUser) SMB 10.129.56.58 445 DC 1101: DANGLINGTREE\DnsAdmins (SidTypeAlias) SMB 10.129.56.58 445 DC 1102: DANGLINGTREE\DnsUpdateProxy (SidTypeGroup) SMB 10.129.56.58 445 DC 1103: DANGLINGTREE\jake.h (SidTypeUser) SMB 10.129.56.58 445 DC 1105: DANGLINGTREE\Cert_Managers (SidTypeGroup) SMB 10.129.56.58 445 DC 1106: DANGLINGTREE\Helpdesk_Cert_Support (SidTypeGroup) SMB 10.129.56.58 445 DC 1107: DANGLINGTREE\Template_Editors (SidTypeGroup) SMB 10.129.56.58 445 DC 1108: DANGLINGTREE\DevOps_PKI (SidTypeGroup) SMB 10.129.56.58 445 DC 1109: DANGLINGTREE\Windows Admin Center CredSSP (SidTypeAlias) SMB 10.129.56.58 445 DC 1110: DANGLINGTREE\svc_mail (SidTypeUser) SMB 10.129.56.58 445 DC 1602: DANGLINGTREE\noah.b (SidTypeUser) SMB 10.129.56.58 445 DC 1603: DANGLINGTREE\support-it (SidTypeGroup) SMB 10.129.56.58 445 DC 1604: DANGLINGTREE\alex.o (SidTypeUser) SMB 10.129.56.58 445 DC 2601: DANGLINGTREE\anderson.w (SidTypeUser) ``` {% endcode %} 1. Kerberoasting failed 2. ASREP roasting failed 3. Tried accessing other shares failed 4. Nothing Interesting in LDAP queries 5. No vulnerable ESC1 templates found Before Giving up, Suddenly I remembered that I did not perform a full port scan {% code expandable="true" %} ``` -p- scan ``` {% endcode %} Ohh Now we see something running on port 6641 kindof webserver lets see.