Hack The Box Connected Stats (Easy Linux)
HTB Connected: active easy Linux box, Season 11 week 3. Rated 3.2/5 from 684 reviews, 13,327 user owns. Difficulty read and prep, spoiler-free.
Connected is week 3 of Hack The Box Season 11, an easy Linux machine by PJ131, worth 20 points and 585 XP. It is still active, so what follows is the season data and an honest read of the difficulty. No chain, no flags.
The numbers
| Machine ID | 906 |
| Difficulty | Easy (20 pts / 585 XP) |
| OS | Linux |
| Released | 2026-06-06 (week 3) |
| Maker | PJ131 |
| Rating | 3.2 / 5 from 684 reviews |
| User owns | 13,327 |
| Root owns | 10,727 |
| User → root drop | 19.5% |
| User blood | 4m 0s by Ap4sh |
| Root blood | 8m 42s by Ap4sh |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Easy | 2,752 | 28.2% |
| Too Easy | 1,786 | 18.3% |
| Cake | 1,743 | 17.9% |
| Very Easy | 1,487 | 15.2% |
| Medium | 936 | 9.6% |
Total votes: 9,753.
Difficulty read
Connected is the season’s problem child. At 3.2 stars from 684 reviews it is the lowest-rated box on the board with a sample worth trusting. Scaffold sits lower at 3.1, on forty-two reviews against Connected’s 684.
What makes it interesting is that the difficulty votes don’t back up the rating. The Easy, Too Easy and Cake buckets between them take about 64% of 9,753 votes. People did not find it hard. They found it irritating.
The number that explains the gap is the user-to-root drop: 19.6%, the highest of any box this season. One in five people who got a shell never rooted it, on a box the crowd calls Easy. That pattern of easy in principle and high abandonment in practice usually means a step that is fiddly, guessy or unstable rather than genuinely difficult.
Do it for the 585 XP. Set your expectations before you start, and if you stall on the root step, it is probably not you.
What to have ready
- Full TCP sweep first:
nmap -p- --min-rate 2000then a targeted-sC -sVon what answers. Easy boxes still hide the point of entry on a high port. - Add the hostname to
/etc/hoststhe moment you see a redirect. Half the failed Easy attempts are people scanning an IP that only serves a vhost. - Vhost and content discovery in parallel:
ffufwith a subdomain wordlist againstHost:, andferoxbusterfor paths, with extensions matched to whatever the stack turns out to be. - Read the source of every page you land on. Comments, JS bundles and
.gitleftovers carry more Easy footholds than any exploit does. - For privesc:
sudo -lbefore anything else, thenlinpeas, then SUID, capabilities, cron and writable service files, in that order.
When the writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Connected retires at the end of Season 11, and the writeup goes up that week, in the same format as the HTB Manage one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Connected is still live.
Related writeups
Retired Linux boxes we’ve already published: