Hack The Box Checkpoint Stats (Medium Windows)

Checkpoint was week 4 of Hack The Box Season 11, a medium Windows machine by AnuragTaparia, worth 30 points and 650 XP. It has retired, so what follows is the final season data and an honest read of the difficulty. No chain, no flags.

The numbers

Machine ID	909
Difficulty	Medium (30 pts / 650 XP)
OS	Windows
Released	2026-06-13 (week 4)
Status	retired, between 2026-09-20 and 2026-11-09
Maker	AnuragTaparia
Rating	4.2 / 5 from 303 reviews
User owns	6,003
Root owns	5,074
User → root drop	15.5%
User blood	12m 43s by ahos6
Root blood	36m 33s by ahos6

Community difficulty votes:

Bucket	Votes	Share
Medium	1,097	27.4%
Bit Hard	804	20.1%
Too Easy	670	16.7%
Hard	613	15.3%
Easy	287	7.2%

Total votes: 4,002.

Difficulty read

Checkpoint was the season’s first Windows box, and the participation cliff is obvious: 6,003 user owns against 15,438 for Connected the week before. Well over half the field simply didn’t play Windows.

For the ones who did, it earned its label. The difficulty votes centred on Medium (1,097 of 4,002) with a substantial Bit Hard tail (804). The community read it as an honest Medium leaning slightly hard, which is rarer than it sounds.

The privesc had real teeth. The blood gap was 23m50s, the widest of the season’s first four weeks by a factor of five, and 15.5% of people with a foothold never converted it. Both numbers point the same direction.

It was the season’s actual difficulty checkpoint: the box where Windows and AD stopped being optional.

What to have ready

• Start with SMB and LDAP: netexec smb, smbclient -L, then ldapsearch or nxc ldap for a null/guest bind. Anonymous reads carry more Windows Mediums than exploits do.
• Collect BloodHound data as soon as you have any credential, with bloodhound-python or SharpHound, and actually query it rather than eyeballing the graph.
• Check ADCS early with certipy find -vulnerable. ESC1 through ESC8 turn up on this tier constantly.
• Kerberos basics: kerbrute for user enumeration, then AS-REP roasting and Kerberoasting on anything you enumerate. Keep clock skew in mind, and ntpdate the DC.
• Privesc: enumerate ACLs on users, groups and OUs with BloodHound, then look at delegation. GenericWrite, WriteDACL and unconstrained delegation are the recurring answers.

When the writeup lands

We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Checkpoint has retired, so the chain is clear to publish and the writeup goes up in the same format as the HTB Lock one.

The team’s internal notes still go out in our Discord first. That’s also where people work through the boxes that are still active together.

Related writeups

Retired Windows boxes we’ve already published:

• HTB Lock Writeup
• HTB Escape Writeup
• HTB Flight Writeup