Hack The Box RedEye Stats (Hard Windows)
HTB RedEye: Season 12 week 8, a hard Windows box by 0xEr3bus and Pho3o, out 2026-11-14 at 19:00 UTC. What we know before release and how to prep.
RedEye is week 8 of Hack The Box Season 12, a hard Windows machine by 0xEr3bus and Pho3o, worth 40 points and 1,105 XP. It goes live at 19:00 UTC on 2026-11-14, so this is the pre-release brief: what HTB has published, what the makers’ record says, and what to have ready. No chain, no flags.
HTB RedEye at a glance
| Machine ID | 1014 |
| Difficulty | Hard (40 pts / 1,105 XP) |
| OS | Windows |
| Released | 2026-11-14, 19:00 UTC (Season 12, week 8) |
| Status | unreleased, drops 2026-11-14 |
| Makers | 0xEr3bus, Pho3o |
| Rating | none yet |
| User owns | none yet |
| Root owns | none yet |
| User blood | none yet |
| Root blood | none yet |
Community difficulty votes open once the box is live. We will add them here with the first numbers.
What we know so far
HTB has published the name, the tier, the OS and the makers, and nothing else: there is no synopsis on the machine page yet. A red-eye is an overnight flight, so the name keeps the season’s run of aviation words going after Layover, Autopilot and Takeoff.
The makers are the pair behind DarkZeroReturns, which is still live from Season 11 and is the reason to take the Hard label on RedEye loosely. DarkZeroReturns also shipped as a Hard. Weighted across the ten vote buckets it scores 77.1 out of 100, above BlockSynergy at 73.9, which is labeled Insane, and at 4.7 it is the best-rated Hard on the board.
0xEr3bus builds Windows and nothing else. Their profile runs DarkCorp (Insane, with ctrlzero), DarkZero (Hard), DarkZeroReturns (Hard, with Pho3o), RedEye, and Handler, the Insane Windows box due a week later. Pho3o’s record is mostly Linux: Snapped, Orion and DutyBound. RedEye is their second Windows machine, and both were built with 0xEr3bus. The DarkZero line is the closest preview there is, so plan for a Hard that may not play like one.
What to have ready for RedEye
- Full TCP sweep first. On Windows the port list tells you the shape of the box: 88, 389 and 445 together mean a domain controller, 5985 means WinRM is a way in once you hold a password.
- Expect the AD groundwork to be locked down: null binds closed, guest disabled, the obvious certificate templates patched. Budget more time for the foothold than for privesc.
- Once anything authenticates, collect BloodHound data and enumerate trusts and cross-domain paths explicitly. On a Hard the answer often lives in another domain or forest.
- Read delegation carefully: constrained, resource-based constrained, and the S4U2Self/S4U2Proxy chain. This tier rewards understanding over tool output.
- Have your tooling proxy-aware before you start:
certipy,bloodhound-python,impacketandnetexecall throughproxychainsorligolo-ng, in case the chain runs through a pivot.
When the RedEye writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. RedEye is not even live yet, so the writeup goes up the week it retires, in the same format as the HTB Vintage one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while RedEye is still live.
Related writeups
Retired hard Windows boxes we’ve already published: