Hack The Box DutyBound Stats (Medium Linux)
HTB DutyBound: Season 12 week 5, a medium Linux box by Pho3o. 3.6/5 from 122 reviews, 1,908 user owns in four days. Live stats and prep, spoiler-free.
DutyBound is week 5 of Hack The Box Season 12, a medium Linux machine by Pho3o, worth 30 points and 845 XP. It went live at 19:00 UTC on 2026-10-24 and has been up for four days, so the numbers are past release night but still moving. No chain, no flags.
HTB DutyBound at a glance
| Machine ID | 999 |
| Difficulty | Medium (30 pts / 845 XP) |
| OS | Linux |
| Released | 2026-10-24 (Season 12, week 5) |
| Status | active, four days live |
| Maker | Pho3o |
| Rating | 3.6 / 5 from 122 reviews |
| User owns | 1,908 |
| Root owns | 1,871 |
| User → root drop | 1.9% |
| User blood | 9m 10s by sig10sh |
| Root blood | 10m 28s by Alardiians |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Medium | 406 | 34.1% |
| Easy | 187 | 15.7% |
| Bit Hard | 159 | 13.3% |
| Too Easy | 156 | 13.1% |
| Hard | 100 | 8.4% |
Total votes: 1,192.
Is HTB DutyBound hard?
It plays like an honest Medium, leaning easy. Weighted across the ten buckets the 1,192 votes land on 47.7 out of 100, the lowest of any Medium on the live board now that MakeSense, which finished at 47.8, has retired. Easy and Too Easy together hold 343 votes against 259 for Bit Hard and Hard.
The 1.9% user-to-root drop is the smallest on the board: 1,871 of 1,908 players who got user also have root. The bloods say the same thing. sig10sh took user at 9m10s and Alardiians took root at 10m28s, 1m18s later, so the fastest privesc on release night went to someone who was not even first in.
That puts the whole difficulty in the foothold. Once you are on the box, almost nobody gets stuck.
3.6 from 122 reviews is middling, the same rating as Management and MakeSense. Pho3o has four machines on HTB: Snapped and DarkZeroReturns, both Hard, then Orion and DutyBound. DarkZeroReturns sits at 4.7 and scores 77.5 on the same weighting, so do not read their name on the card as a warning.
What to have ready for DutyBound
- Full TCP sweep, then UDP on the top 100. Mediums are where a forgotten SNMP or TFTP service starts mattering.
- Add the hostname to
/etc/hoststhe moment you see a redirect, then enumerate every vhost. On this tier the foothold usually lives on a name you have to find. - If there’s an app you can name, go read its source on GitHub rather than firing exploits at it. Version-matched source review is the fastest path on a Medium.
- Know the injection families cold: SSTI, deserialization, SSRF into an internal service, and file-upload chains that end in a webshell.
- Privesc:
sudo -landlinpeasfirst. A 1.9% drop says root is close to wherever you land.
When the DutyBound writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. DutyBound is still live, so the writeup goes up the week it retires, in the same format as the HTB Heal one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while DutyBound is still live.
Related writeups
Retired medium Linux boxes we’ve already published: