DanglingTree

Hack The Box · app.hackthebox.com/machines/DanglingTree

Windows Medium Season 11 Active Directory ADCS · ESC1 User Root ● Completed writeup after season

Summary A single-VM Windows Server 2025 Active Directory Domain Controller that lives up to its name in the final act. Full compromise meant chaining through five identities, each unlocked by a different technique — remote code execution in Windows Admin Center, an unauthenticated reset in an internal mail server, a mailbox domain-swap trick to recover a hidden AD password, and a SAMR password reset — to reach a user who could abuse the box's signature flaw: a dangling AD Certificate Services template reference. The CA advertised certificate templates that no longer existed as AD objects, so creating an object with the right name turned an ordinary container permission into an ESC1 path to Domain Admin.

01Why the full writeup is held back

DanglingTree is a live Season 11 machine, so in line with Hack The Box's guidance on active machines I am not publishing the step-by-step reproduction, commands, credentials or flags. The complete walkthrough — the full identity chain, the ADCS exploitation and a client-style remediation plan — goes live here once the season closes.

02The interesting bits (no spoilers)

The name is the hint

A stale, unreachable DNS record for the bare domain name sits alongside the correct Domain Controller record — quietly breaking any tool that resolves the domain instead of the host. That "dangling" pattern turned out to be deliberate foreshadowing for the box's real vulnerability.

A certificate authority trusting ghosts

The heart of the box is an ADCS misconfiguration I hadn't hit in a lab before: the CA published several certificate templates as "enabled" that had no backing Active Directory object at all. Because the CA never re-validates that a published template still exists, anyone with write access to the templates container can create an object under that exact name and instantly gain a live, requestable — and in this case ESC1-vulnerable — template. A dangling reference became a domain takeover.

Five identities, five different techniques

Getting to the account with that write access was the real work: a browser-driven RCE in a management console, an unauthenticated password-reset flaw in an internal mail platform, a creative mailbox domain-swap to read a password that wasn't meant to be reachable, an Active Directory ACL edge, and a protocol switch to land a password reset the "normal" way refused to allow.

Picking the right protocol matters

Two steps only worked once I stopped fighting the obvious transport: LDAP password changes failed consistently, but the SAMR protocol reset the account cleanly; and WinRM was filtered from outside, so the final Domain-Admin shell came over RPC/SMB rather than the tool everyone reaches for first.

03Takeaways

Audit your CA for dangling templates. A certificate template published on the CA with no matching AD object is a latent domain-compromise primitive; reconcile the CA's published list against real objects and alert on the gap.
Treat the certificate-templates container as Tier 0. CreateChild there is effectively "mint yourself a template" — it must never sit with a non-PKI-admin group.
ESC1 is still the classic. Enrollee-supplied Subject Alternative Names plus enrol rights for everyone is all it takes to forge an Administrator certificate.
Chains beat single bugs. No one flaw here was game-over on its own; five moderate issues across web, mail and AD composed into full compromise.
Straight into the day job: detection for new certificate-template objects, enrollee-supplied-SAN requests, SAMR password resets, management-console RCE and unauthenticated mail-admin calls, plus a Windows Server 2025 / DISA STIG and ADCS hardening baseline.

Coming after Season 11 Full technical walkthrough with the enumeration, the five-identity chain, the dangling-template ESC1 exploitation to Domain Admin, and a prioritised remediation and hardening plan mapped to NIST 800-53/171, the DISA Windows Server 2025 / Active Directory STIG and the CIS Benchmark.

back to writeups