Hack The Box Paperwork Stats (Easy Linux)
HTB Paperwork: active easy Linux box, Season 11 week 8. Rated 4.1/5 from 335 reviews, 6,737 user owns. Difficulty read and prep, spoiler-free.
Paperwork is week 8 of Hack The Box Season 11, an easy Linux machine by LazyTitan33, worth 20 points and 585 XP. It is still active, so what follows is the season data and an honest read of the difficulty. No chain, no flags.
The numbers
| Machine ID | 921 |
| Difficulty | Easy (20 pts / 585 XP) |
| OS | Linux |
| Released | 2026-07-11 (week 8) |
| Maker | LazyTitan33 |
| Rating | 4.1 / 5 from 335 reviews |
| User owns | 6,737 |
| Root owns | 6,507 |
| User → root drop | 3.4% |
| User blood | 6m 25s by admiin |
| Root blood | 7m 36s by admiin |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Too Easy | 1,314 | 28.4% |
| Easy | 1,313 | 28.4% |
| Medium | 754 | 16.3% |
| Bit Hard | 314 | 6.8% |
| Very Easy | 283 | 6.1% |
Total votes: 4,630.
Difficulty read
Paperwork has the tightest blood gap of the season: 71 seconds between user and root, both taken by the same player. The user-to-root drop is 3.4%, the second-lowest of Season 11 behind DevHub.
There is essentially no privesc stage here. Whatever gets you a shell gets you root almost immediately after.
The community reads it as a straightforward Easy, with Easy and Too Easy taking about 57% of 4,630 votes, and rates it 4.1, which for a box this short is a solid score. Nobody felt cheated.
Everything that matters happens before your first shell. Slow down on enumeration and the rest of the box will take care of itself. It is the shortest chain in Season 11.
What to have ready
- Full TCP sweep first:
nmap -p- --min-rate 2000then a targeted-sC -sVon what answers. Easy boxes still hide the point of entry on a high port. - Add the hostname to
/etc/hoststhe moment you see a redirect. Half the failed Easy attempts are people scanning an IP that only serves a vhost. - Vhost and content discovery in parallel:
ffufwith a subdomain wordlist againstHost:, andferoxbusterfor paths, with extensions matched to whatever the stack turns out to be. - Read the source of every page you land on. Comments, JS bundles and
.gitleftovers carry more Easy footholds than any exploit does. - For privesc:
sudo -lbefore anything else, thenlinpeas, then SUID, capabilities, cron and writable service files, in that order.
When the writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Paperwork retires at the end of Season 11, and the writeup goes up that week, in the same format as the HTB Magic one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Paperwork is still live.
Related writeups
Retired Linux boxes we’ve already published: