Hack The Box DarkZeroReturns Stats (Hard Windows)
HTB DarkZeroReturns: active hard Windows box, Season 11 week 10. Rated 4.7/5 from 118 reviews, 2,071 user owns. Difficulty read and prep, spoiler-free.
DarkZeroReturns is week 10 of Hack The Box Season 11, a hard Windows machine by 0xEr3bus and Pho3o, worth 40 points and 1,105 XP. It is still active, so what follows is the season data and an honest read of the difficulty. No chain, no flags.
The numbers
| Machine ID | 930 |
| Difficulty | Hard (40 pts / 1,105 XP) |
| OS | Windows |
| Released | 2026-07-25 (week 10) |
| Maker | 0xEr3bus, Pho3o |
| Rating | 4.7 / 5 from 118 reviews |
| User owns | 2,071 |
| Root owns | 1,864 |
| User → root drop | 10.0% |
| User blood | 37m 48s by Ap4sh |
| Root blood | 2h 2m 11s by Sm1l3z |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Brain Fuck | 377 | 25.3% |
| Hard | 310 | 20.8% |
| Too Hard | 296 | 19.9% |
| Ex Hard | 259 | 17.4% |
| Medium | 63 | 4.2% |
Total votes: 1,489.
Difficulty read
DarkZeroReturns is the boss fight of Season 11 and the numbers are not subtle about it.
It is the highest-rated box of Season 11 at 4.7 stars. It is also the one the community most strongly disagrees with the label on: the single largest bucket in the difficulty histogram is Brain Fuck at 377 of 1,489 votes. Add Ex Hard and Too Hard and you have roughly two-thirds of all votes sitting above the Hard bucket. It ships labeled Hard; it plays Insane.
The bloods say the same thing. User blood took 37m48s and root blood 2h02m11s, a gap of nearly an hour and a half, more than double any other box this season. Participation is the second lowest of the season at 2,071 user owns, behind only BlockSynergy, which is an Insane released four months later; most of the field looked at it and left.
And it still rates 4.7. That combination of brutal, mislabeled and beloved is the community’s way of saying it’s hard and fair, which is the rarest thing a box maker can pull off. 0xEr3bus built the original DarkZero; this is the sequel, and it is the one to save for a weekend rather than a weeknight.
What to have ready
- Same AD groundwork as a Medium, but expect it to be locked down: null binds closed, obvious ADCS templates patched. Budget more time for the foothold than for privesc.
- Enumerate trusts and cross-domain paths explicitly. On Hard, the answer often lives in another domain or forest.
- Have your tooling proxy-aware and ready to run through a pivot:
certipy,bloodhound-python,impacketandnetexecall viaproxychains. - Read delegation chains carefully: constrained, resource-based constrained, and the S4U2Self/S4U2Proxy dance. This tier rewards understanding over tool output.
- Expect a custom service or bespoke application somewhere in the chain. Reverse it rather than fuzzing it.
When the writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. DarkZeroReturns retires at the end of Season 11, and the writeup goes up that week, in the same format as the HTB Monteverde one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while DarkZeroReturns is still live.
Related writeups
Retired Windows boxes we’ve already published: