Hack The Box DanglingTree Stats (Medium Windows)
HTB DanglingTree: active medium Windows box, Season 11 week 12. Rated 4.2/5 from 158 reviews, 2,953 user owns. Difficulty read and prep, spoiler-free.
DanglingTree is week 12 of Hack The Box Season 11, a medium Windows machine by EmSec, worth 30 points and 845 XP. It is still active, so what follows is the season data and an honest read of the difficulty. No chain, no flags.
The numbers
| Machine ID | 936 |
| Difficulty | Medium (30 pts / 845 XP) |
| OS | Windows |
| Released | 2026-08-08 (week 12) |
| Maker | EmSec |
| Rating | 4.2 / 5 from 158 reviews |
| User owns | 2,953 |
| Root owns | 2,717 |
| User → root drop | 8.0% |
| User blood | 41m 4s by xtk |
| Root blood | 50m 40s by admiin |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Hard | 564 | 26.2% |
| Medium | 341 | 15.8% |
| Too Hard | 339 | 15.8% |
| Bit Hard | 311 | 14.5% |
| Brain Fuck | 167 | 7.8% |
Total votes: 2,152.
Difficulty read
DanglingTree is labelled Medium and the community does not agree. Only 15.8% of 2,152 votes picked the Medium bucket. Hard alone took 26.2%, and 57.2% put it at Hard or worse. Weight the ten buckets evenly from Cake to Brainfuck and the box scores 66.0 out of 100, against 54.5 for Checkpoint, the season’s other Windows Medium, and 62.4 for Nimbus, which ships with a Hard label. On the numbers it is comfortably the hardest Medium of Season 11, and harder than one of its Hards.
The bloods say the same thing louder. User blood took 41m04s, the slowest first user flag of the entire season, slower even than DarkZeroReturns (37m48s), a Hard. Every other box this season gave up user in under 13 minutes.
Then the shape flips. Root blood landed 9m36s later, at 50m40s. Compare that gap to Checkpoint’s 23m50s, Nimbus’s 41m34s or DarkZeroReturns’ 1h24m23s: on DanglingTree the wall is the foothold, and the privesc is short once you are on the box. The 7.7% user to root drop backs it up, well under Checkpoint’s final 15.5% and Connected’s 19.6%. Almost nobody who gets a shell gets stuck.
None of that hurt it: 4.2 / 5 from 158 reviews puts it level with Checkpoint and just behind Bedside, and above every other Linux Medium this season. Boxes that punish enumeration and then pay out cleanly tend to review well.
Owns are still climbing, but 2,953 user owns already beats DarkZeroReturns’ 2,071 across more than twice the uptime, so the Windows tax on participation is smaller here than the Hard label usually costs.
Budget enumeration time, not exploit time. If you are stuck two hours in with no foothold, that is the intended experience, not a missed hint.
TrustFall, EmSec’s other box, was slated for 2026-08-15 as the season’s only Insane and missed the date. The closing slot went to BlockSynergy, an insane Linux box by R00cKet, on 2026-08-29, which leaves DanglingTree as the last Windows machine of Season 11. TrustFall itself released on 2026-09-11, outside the season and without season points.
What to have ready
- Start with SMB and LDAP:
netexec smb,smbclient -L, thenldapsearchornxc ldapfor a null/guest bind. Anonymous reads carry more Windows Mediums than exploits do. - Collect BloodHound data as soon as you have any credential, with
bloodhound-pythonorSharpHound, and actually query it rather than eyeballing the graph. - Check ADCS early with
certipy find -vulnerable. ESC1 through ESC8 turn up on this tier constantly. - Kerberos basics:
kerbrutefor user enumeration, then AS-REP roasting and Kerberoasting on anything you enumerate. Keep clock skew in mind, andntpdatethe DC. - Privesc: enumerate ACLs on users, groups and OUs with BloodHound, then look at delegation.
GenericWrite,WriteDACLand unconstrained delegation are the recurring answers.
When the writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. DanglingTree retires at the end of Season 11, and the writeup goes up that week, in the same format as the HTB Baby one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while DanglingTree is still live.
Related writeups
Retired Windows boxes we’ve already published: