Hack The Box Garfield Stats (Hard Windows)
HTB Garfield: retired hard Windows box, 4.5/5 from 219 reviews, 4,406 user owns. Final stats, difficulty read and prep. Spoiler-free, no flags.
Garfield was an active Hack The Box machine, a hard Windows box by ruycr4ft, released 2026-04-04 in Season 10, worth 40 points and 850 XP. It retired after six to seven months live, so what follows is the final data and an honest read of the difficulty. No chain, no flags, no spoilers.
HTB Garfield at a glance
| Machine ID | 862 |
| Difficulty | Hard (40 pts / 850 XP) |
| OS | Windows |
| Released | 2026-04-04 (Season 10) |
| Status | retired, between 2026-09-21 and 2026-11-09 |
| Maker | ruycr4ft |
| Rating | 4.5 / 5 from 219 reviews |
| User owns | 4,406 |
| Root owns | 3,692 |
| User → root drop | 16.2% |
| User blood | 19m 30s by ahos6 |
| Root blood | 45m 5s by 0x4C616E |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Hard | 847 | 27.3% |
| Medium | 518 | 16.7% |
| Bit Hard | 495 | 16.0% |
| Too Hard | 330 | 10.6% |
| Too Easy | 307 | 9.9% |
Total votes: 3,103.
Is HTB Garfield hard?
Garfield retired at 4.5 from 219 reviews, and unusually for a Hard, plenty of people finished it: 4,406 user owns, which is Medium-tier participation on a 40-point box.
The votes were broad rather than brutal. Hard led at 847 of 3,103, but Medium (518), Bit Hard (495) and even Too Easy (307) all carried weight. Read that as a Hard with an approachable foothold and a real climb behind it.
Which is exactly what the numbers show: ahos6 took user blood at 19m30s, but root blood went to a different player, 0x4C616E, at 45m05s, more than double. The 16.2% user-to-root drop was one of the widest on the board: at our September refresh only Connected and Nimbus were wider. A meaningful share of players got in and then stalled.
For anyone stepping up from Medium Windows boxes it was a sensible first Hard: the entry was fair, and the difficulty was concentrated where it should be. Same maker as Pirate, ruycr4ft, and the two make a good pair.
What to have ready for Garfield
- Same AD groundwork as a Medium, but expect it to be locked down: null binds closed, obvious ADCS templates patched. Budget more time for the foothold than for privesc.
- Enumerate trusts and cross-domain paths explicitly. On Hard, the answer often lives in another domain or forest.
- Have your tooling proxy-aware and ready to run through a pivot:
certipy,bloodhound-python,impacketandnetexecall viaproxychains. - Read delegation chains carefully: constrained, resource-based constrained, and the S4U2Self/S4U2Proxy dance. This tier rewards understanding over tool output.
- Expect a custom service or bespoke application somewhere in the chain. Reverse it rather than fuzzing it.
When the Garfield writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Garfield has retired, so the chain is clear to publish and the writeup goes up in the same format as the HTB Flight one.
The team’s internal notes still go out in our Discord first. That’s also where people work through the boxes that are still active together.
Related writeups
Retired Windows boxes we’ve already published: