Hack The Box Scaffold Stats (Hard Windows)
HTB Scaffold: active hard Windows box, 3.1/5 from 42 reviews, 582 user owns. Live stats, difficulty read and prep. Spoiler-free, no flags.
Scaffold is an active Hack The Box machine, a hard Windows box by EmSec, released 2026-09-05 outside the seasonal rotation, worth 40 points and 1,105 XP. It has been live for two weeks and has not retired, so what follows is the current data and an honest read of the difficulty. No chain, no flags, no spoilers.
HTB Scaffold at a glance
| Machine ID | 978 |
| Difficulty | Hard (40 pts / 1,105 XP) |
| OS | Windows |
| Released | 2026-09-05 |
| Status | active, two weeks live |
| Maker | EmSec |
| Rating | 3.1 / 5 from 42 reviews |
| User owns | 582 |
| Root owns | 532 |
| User → root drop | 8.6% |
| User blood | 28m 7s by admiin |
| Root blood | 10m 46s by ahos6 |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Hard | 90 | 24.9% |
| Cake | 60 | 16.6% |
| Medium | 42 | 11.6% |
| Too Hard | 37 | 10.2% |
| Bit Hard | 33 | 9.1% |
Total votes: 362.
Root came before user
The blood times are the wrong way round. ahos6 took root at 10m46s; admiin took user at 28m07s, seventeen minutes later. Those are different players, and the timestamps are from the API rather than a reading of the scoreboard.
A box where root is bled before user usually means one of two things: the chain reaches SYSTEM without passing through an unprivileged shell, or the user flag sits somewhere the intended path does not walk past. Either way it tells you not to treat this as a two-stage box with a tidy midpoint.
Is HTB Scaffold hard?
The histogram cannot make up its mind. Hard leads at 90 of 362, which is what the label says, but Cake is second at 60. Sixty people out of 362 called a 40-point Hard trivial while ninety called it Hard and another thirty-seven called it Too Hard. Weighted out it lands at 54.7 of 100, which is Medium territory and almost exactly where Checkpoint, a Medium, retired at 54.5.
A split like that is usually a box with one gate. Know the trick and it falls in an evening; miss it and you are stuck with nothing to enumerate. The 8.6% user-to-root drop supports that reading: once people are in, they finish.
The rating is the headline and it is not kind. 3.1 from 42 reviews is the lowest on the board, under Connected at 3.2. Forty-two reviews is a thin sample and it may recover, but a Hard that a sixth of players call Cake is not a Hard that gets recommended.
Same maker as DanglingTree and co-author of TrustFall, which makes this the weakest-received of EmSec’s three recent boxes by a wide margin.
What to have ready for Scaffold
- Same AD groundwork as a Medium, but expect it to be locked down: null binds closed, obvious ADCS templates patched. Budget more time for the foothold than for privesc.
- Enumerate trusts and cross-domain paths explicitly. On Hard, the answer often lives in another domain or forest.
- Have your tooling proxy-aware and ready to run through a pivot:
certipy,bloodhound-python,impacketandnetexecall viaproxychains. - Read delegation chains carefully: constrained, resource-based constrained, and the S4U2Self/S4U2Proxy dance. This tier rewards understanding over tool output.
- Given the blood order, enumerate for SYSTEM-level paths from the start rather than assuming you need a user shell first.
When the Scaffold writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Scaffold is still live, so the writeup goes up the week it retires, in the same format as the HTB Flight one.
If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Scaffold is still live.
Related writeups
Retired Windows boxes we’ve already published: