Hack The Box Pirate Stats (Hard Windows)
HTB Pirate: retired hard Windows box, 4.7/5 from 363 reviews, 3,932 user owns. Final stats, difficulty read and prep. Spoiler-free, no flags.
Pirate was an active Hack The Box machine, a hard Windows box by ruycr4ft, released 2026-02-28 in Season 10, worth 40 points and now 850 XP. It retired after roughly six months live, so what follows is the final data and an honest read of the difficulty. No chain, no flags, no spoilers.
HTB Pirate at a glance
| Machine ID | 844 |
| Difficulty | Hard (40 pts / 850 XP) |
| OS | Windows |
| Released | 2026-02-28 (Season 10) |
| Status | retired, between 2026-08-15 and 2026-09-10 |
| Maker | ruycr4ft |
| Rating | 4.7 / 5 from 363 reviews |
| User owns | 3,932 |
| Root owns | 3,862 |
| User → root drop | 1.8% |
| User blood | 30m 33s by Pyp |
| Root blood | 41m 30s by Mojo098 |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Hard | 1,174 | 35.6% |
| Too Hard | 546 | 16.5% |
| Bit Hard | 409 | 12.4% |
| Medium | 363 | 11.0% |
| Ex Hard | 247 | 7.5% |
Total votes: 3,301.
Is HTB Pirate hard?
Pirate finished as the best-reviewed Hard on the board, at 4.7 from 363 reviews, and it still holds more reviews than any Hard now active: 363 against 205 for Garfield. That is what a box people recommend to each other looks like.
The votes sit exactly where the label says: 1,174 Hard out of 3,301, with Too Hard (546) and Bit Hard (409) either side. Only 363 argued Medium. An honest Hard, in other words.
The standout number is the user-to-root drop: 1.8%. Of 3,932 people who took user, 3,862 went on to take root. That is the second tightest gap on the board, behind DevHub at 1.5%, and it means the foothold is the entire box: clear it and root follows.
Bloods were 30m33s (Pyp) and 41m30s (Mojo098), eleven minutes apart, consistent with the same picture.
Plan your time accordingly: most of it went into getting that first shell. Same maker as Garfield, ruycr4ft.
What to have ready for Pirate
- Same AD groundwork as a Medium, but expect it to be locked down: null binds closed, obvious ADCS templates patched. Budget more time for the foothold than for privesc.
- Enumerate trusts and cross-domain paths explicitly. On Hard, the answer often lives in another domain or forest.
- Have your tooling proxy-aware and ready to run through a pivot:
certipy,bloodhound-python,impacketandnetexecall viaproxychains. - Read delegation chains carefully: constrained, resource-based constrained, and the S4U2Self/S4U2Proxy dance. This tier rewards understanding over tool output.
- Expect a custom service or bespoke application somewhere in the chain. Reverse it rather than fuzzing it.
When the Pirate writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Pirate has retired, so the chain is clear to publish and the writeup goes up in the same format as the HTB Monteverde one.
The team’s internal notes still go out in our Discord first. That’s also where people work through the boxes that are still active together.
Related writeups
Retired Windows boxes we’ve already published: