Hack The Box Handler Stats (Insane Windows)
HTB Handler: Season 12 week 9, an insane Windows box by 0xEr3bus, out 2026-11-21 at 19:00 UTC. Starts with given creds. What we know and how to prep.
Handler is week 9 of Hack The Box Season 12, an insane Windows machine by 0xEr3bus, worth 50 points and 1,365 XP. It goes live at 19:00 UTC on 2026-11-21, so this is the pre-release brief: what HTB has published, what the maker’s record says, and what to have ready. No chain, no flags.
HTB Handler at a glance
| Machine ID | 1017 |
| Difficulty | Insane (50 pts / 1,365 XP) |
| OS | Windows |
| Released | 2026-11-21, 19:00 UTC (Season 12, week 9) |
| Status | unreleased, drops 2026-11-21 |
| Maker | 0xEr3bus |
| Rating | none yet |
| User owns | none yet |
| Root owns | none yet |
| User blood | none yet |
| Root blood | none yet |
Community difficulty votes open once the box is live. We will add them here with the first numbers.
What we know so far
Handler starts the way a real internal test often does: from an account someone handed you. HTB’s machine page already says so, before the box boots:
As is common in real life pentests, you will start the Handler box with credentials for the following account: ext.dmalik / HTB-AirwaysAudit2026!
So the first hour is not about getting in. It is about working out what ext.dmalik can reach. The ext. prefix reads like an external contractor’s account and the password like an airline audit engagement, which fits the season’s aviation run from Layover to RedEye. That is a reading of two strings, not a hint about the chain. There is no synopsis on the machine page yet.
Handler is 0xEr3bus’s second machine in two weeks, after RedEye on 2026-11-14, and their first solo build since DarkZero. Everything on their profile is Windows: DarkCorp (Insane, with ctrlzero, rated 4.8 when it retired), DarkZero (Hard), DarkZeroReturns (Hard, with Pho3o), RedEye and Handler. DarkZeroReturns is still live and is the best guide to how this maker grades: it ships as a Hard, the community’s votes weight it at 77.1 out of 100, above the 73.9 of BlockSynergy, an Insane, and it is the best-rated Hard on the board at 4.7. Handler carries the Insane label to begin with.
It is the last machine HTB has announced for Season 12, which ends on 2026-11-28.
What to have ready for Handler
- Test the given account everywhere before anything else: SMB, LDAP, WinRM, MSSQL, RDP and any web login.
nxcagainst each protocol tells you in a minute where a credential works. - Collect BloodHound data with it straight away and read the graph outward from
ext.dmalik: group memberships, ACLs, delegation, certificate templates (certipy find -vulnerable). On an assumed-breach box the first edge is usually in there. - Plan for a multi-day box. Take structured notes from minute one, and keep every credential, hash, ticket and certificate in one table with where it came from and what it opened.
- Have pivoting working end to end before you start.
ligolo-ngorchisel, tested, so a second network does not cost you an evening. - Expect custom code or a service you have to read rather than look up. Insane boxes reward reverse engineering and patient primitive-chaining.
When the Handler writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Handler is not even live yet, so the writeup goes up the week it retires, in the same format as the HTB Rebound one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Handler is still live.
Related writeups
Retired insane Windows boxes we’ve already published: