Hack The Box Layover Stats (Medium Linux)
HTB Layover: the Season 12 opener, a medium Linux box by TRX. 4.3/5 from 7 reviews, 177 user owns on day one. Live stats and prep, spoiler-free.
Layover is week 1 of Hack The Box Season 12, a medium Linux machine by TRX, worth 30 points and 845 XP. It went live at 19:00 UTC on 2026-09-26 and these numbers are from three and a half hours later, so read them as a first look rather than a verdict. No chain, no flags.
HTB Layover at a glance
| Machine ID | 984 |
| Difficulty | Medium (30 pts / 845 XP) |
| OS | Linux |
| Released | 2026-09-26 (Season 12, week 1) |
| Status | active, released today |
| Maker | TRX |
| Rating | 4.3 / 5 from 7 reviews |
| User owns | 177 |
| Root owns | 145 |
| User → root drop | 18.1% |
| User blood | 23m 34s by ahos6 |
| Root blood | 28m 18s by ahos6 |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Medium | 24 | 30.4% |
| Too Easy | 13 | 16.5% |
| Bit Hard | 13 | 16.5% |
| Hard | 11 | 13.9% |
| Cake | 6 | 7.6% |
Total votes: 79.
Is HTB Layover hard?
It looks like a Medium that means it. Weight the ten buckets from Cake to Brainfuck and the 79 votes land on 50.3 out of 100, almost exactly the middle of the scale. The spread around that centre is wide: 26 votes sit below Medium and 29 above it, with Medium itself the single largest bucket at 24. Nobody agrees it is easy, and nobody agrees it is hard.
Both bloods went to ahos6, who also took user on Checkpoint: user at 23m34s and root at 28m18s, 4m44s apart. Of the seven Mediums we track, only DanglingTree took longer to first user (41m04s), and Bedside, the last Medium Linux box of Season 11, fell in 7m57s. The short gap between the two bloods says the foothold is where the time goes.
The 18.1% user-to-root drop cuts the other way, since 32 of the 177 players who got in have not finished yet. Treat it with care. On release night the people posting owns are the fastest on the platform, and a gap this early mostly measures who has gone to bed. Expect it to shrink as the week goes on.
Seven reviews at 4.3 is too thin to mean much yet.
TRX is a Hack The Box moderator and Layover is their sixth machine, after Control, Magic, Cerberus, TwoMillion and Surveillance. That is a maker with a long record of well-built boxes, and Magic is the one to read if you want a feel for how they build a Medium Linux chain.
What to have ready for Layover
- Full TCP sweep, then UDP on the top 100. Mediums are where a forgotten SNMP or TFTP service starts mattering.
- Add the hostname to
/etc/hoststhe moment you see a redirect, then enumerate every vhost. On this tier the foothold usually lives on a name you have to find. - If there’s an app you can name, go read its source on GitHub rather than firing exploits at it. Version-matched source review is the fastest path on a Medium.
- Know the injection families cold: SSTI, deserialization, SSRF into an internal service, and file-upload chains that end in a webshell.
- Privesc: enumerate as every user you land on, not just the first.
sudo -l,linpeas, then group membership, then anything in/optthat someone wrote themselves.
When the Layover writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Layover is still live, so the writeup goes up the week it retires, in the same format as the HTB Magic one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Layover is still live.
Related writeups
Retired Linux boxes we’ve already published: