Hack The Box Cohort Stats (Easy Linux)
HTB Cohort: active easy Linux box, Season 11 week 11. Rated 3.8/5 from 286 reviews, 6,617 user owns. Difficulty read and prep, spoiler-free.
Cohort is week 11 of Hack The Box Season 11, an easy Linux machine by TheCyberGeek, worth 20 points and 585 XP. It is still active, so what follows is the season data and an honest read of the difficulty. No chain, no flags.
The numbers
| Machine ID | 933 |
| Difficulty | Easy (20 pts / 585 XP) |
| OS | Linux |
| Released | 2026-08-01 (week 11) |
| Maker | TheCyberGeek |
| Rating | 3.8 / 5 from 286 reviews |
| User owns | 6,617 |
| Root owns | 5,993 |
| User → root drop | 9.4% |
| User blood | 7m 10s by ahos6 |
| Root blood | 18m 5s by Retro16 |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Easy | 1,683 | 38.8% |
| Too Easy | 1,137 | 26.2% |
| Medium | 466 | 10.7% |
| Very Easy | 399 | 9.2% |
| Cake | 285 | 6.6% |
Total votes: 4,336.
Difficulty read
Cohort was the season’s week 11 box, and the numbers have settled since release. DanglingTree followed it in week 12, and BlockSynergy closed the season out on 2026-08-29.
It sits at 3.8 stars from 286 reviews, with the difficulty votes firmly in Easy territory: Easy and Too Easy take about 65% of 4,336 votes.
One detail worth flagging. The bloods were taken by two different players: user by ahos6 at 7m10s, root by Retro16 at 18m05s. That 10m55s gap is wide for an Easy. Paired with a 9.4% user-to-root drop, it suggests the privesc has a bit more in it than the label implies.
Season 11 closed on 2026-09-05, so the season points are settled, but the box itself is still live: machines stay on the board for months after their season ends, and Cohort has not retired.
What to have ready
- Full TCP sweep first:
nmap -p- --min-rate 2000then a targeted-sC -sVon what answers. Easy boxes still hide the point of entry on a high port. - Add the hostname to
/etc/hoststhe moment you see a redirect. Half the failed Easy attempts are people scanning an IP that only serves a vhost. - Vhost and content discovery in parallel:
ffufwith a subdomain wordlist againstHost:, andferoxbusterfor paths, with extensions matched to whatever the stack turns out to be. - Read the source of every page you land on. Comments, JS bundles and
.gitleftovers carry more Easy footholds than any exploit does. - For privesc:
sudo -lbefore anything else, thenlinpeas, then SUID, capabilities, cron and writable service files, in that order.
When the writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Cohort retires at the end of Season 11, and the writeup goes up that week, in the same format as the HTB Admirer one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Cohort is still live.
Related writeups
Retired Linux boxes we’ve already published: