Hack The Box DevHub Stats (Medium Linux)
HTB DevHub: retired medium Linux box, Season 11 week 2. Rated 4/5 from 541 reviews, 9,517 user owns. Final stats and prep, spoiler-free.
DevHub was week 2 of Hack The Box Season 11, a medium Linux machine by Neetrox, worth 30 points and 650 XP. It has retired, so what follows is the final season data and an honest read of the difficulty. No chain, no flags.
The numbers
| Machine ID | 903 |
| Difficulty | Medium (30 pts / 650 XP) |
| OS | Linux |
| Released | 2026-05-30 (week 2) |
| Status | retired, between 2026-09-20 and 2026-11-09 |
| Maker | Neetrox |
| Rating | 4 / 5 from 541 reviews |
| User owns | 9,517 |
| Root owns | 9,363 |
| User → root drop | 1.6% |
| User blood | 6m 21s by xtk |
| Root blood | 8m 20s by ahos6 |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Easy | 2,668 | 35.8% |
| Too Easy | 1,530 | 20.5% |
| Medium | 1,264 | 16.9% |
| Very Easy | 765 | 10.3% |
| Cake | 644 | 8.6% |
Total votes: 7,462.
Difficulty read
DevHub finished with the most lopsided numbers of its season. The user-to-root drop was 1.6%, the lowest of any box in Season 11 by a wide margin, with Paperwork next at 3.8%. Of the 9,517 people who got a foothold, 9,363 rooted it. Root blood followed user blood by 1m59s.
Read that plainly: the foothold was the box. Once you were on it, the privesc did not meaningfully filter anybody.
The community also disagreed with the Medium label. Easy and Too Easy together took 56.3% of the 7,462 difficulty votes; Medium took 16.9%. It was a Medium in points and an Easy in play.
Where it actually cost people time was enumeration. Boxes with this profile almost always hide the entry point somewhere you have to look for, and everything after it is quick.
What to have ready
- Full TCP sweep, then UDP on the top 100. Mediums are where a forgotten SNMP or TFTP service starts mattering.
- Enumerate every vhost. On this tier the foothold usually lives on a name you have to find, not on the default site.
- If there’s an app you can name, go read its source on GitHub rather than firing exploits at it. Version-matched source review is the fastest path on a Medium.
- Know the injection families cold: SSTI, deserialization, SSRF into an internal service, and file-upload chains that end in a webshell.
- Privesc: enumerate as every user you land on, not just the first.
linpeas, then group membership, then anything in/optthat someone wrote themselves.
When the writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. DevHub has retired, so the chain is clear to publish and the writeup goes up in the same format as the HTB Academy one.
The team’s internal notes still go out in our Discord first. That’s also where people work through the boxes that are still active together.
Related writeups
Retired Linux boxes we’ve already published: