Hack The Box SmartHire Stats (Medium Linux)
HTB SmartHire: retired medium Linux box, 3.5/5 from 187 reviews, 3,911 user owns. Final stats, difficulty read and prep. Spoiler-free, no flags.
SmartHire was an active Hack The Box machine, a medium Linux box by redtrib3, released 2026-05-16 outside the seasonal rotation, worth 30 points and 650 XP. It retired after four to six months live, so what follows is the final data and an honest read of the difficulty. No chain, no flags, no spoilers.
HTB SmartHire at a glance
| Machine ID | 897 |
| Difficulty | Medium (30 pts / 650 XP) |
| OS | Linux |
| Released | 2026-05-16 |
| Status | retired, between 2026-09-20 and 2026-11-09 |
| Maker | redtrib3 |
| Rating | 3.5 / 5 from 187 reviews |
| User owns | 3,911 |
| Root owns | 3,785 |
| User → root drop | 3.2% |
| User blood | 6m 42s by Ap4sh |
| Root blood | 7m 28s by Ap4sh |
Community difficulty votes:
| Bucket | Votes | Share |
|---|---|---|
| Easy | 759 | 27.5% |
| Too Easy | 624 | 22.6% |
| Medium | 620 | 22.5% |
| Very Easy | 236 | 8.6% |
| Cake | 207 | 7.5% |
Total votes: 2,756.
Is HTB SmartHire hard?
SmartHire was the clearest case of a mislabeled box on the active list. It shipped as a Medium, but 66.3% of the 2,756 difficulty votes put it below that: Easy (759), Too Easy (624), Very Easy (236) and Cake (207) together, against 620 for Medium.
The rating tracked that disappointment: 3.5 from 187 reviews, and at our September refresh only Connected rated lower among the machines still live. Boxes that play a tier under their label tend to land there.
Both bloods went to Ap4sh, 46 seconds apart: user at 6m42s, root at 7m28s. That is a formality rather than a privesc, and the 3.2% user-to-root drop across the whole player base says the same thing.
It played as a fast, low-friction Linux box rather than as Medium practice. If you want a Medium that behaves like one, the writeup will not be the place to find it.
What to have ready for SmartHire
- Full TCP sweep, then UDP on the top 100. Mediums are where a forgotten SNMP or TFTP service starts mattering.
- Enumerate every vhost. On this tier the foothold usually lives on a name you have to find, not on the default site.
- If there’s an app you can name, go read its source on GitHub rather than firing exploits at it. Version-matched source review is the fastest path on a Medium.
- Know the injection families cold: SSTI, deserialization, SSRF into an internal service, and file-upload chains that end in a webshell.
- Privesc: enumerate as every user you land on, not just the first.
linpeas, then group membership, then anything in/optthat someone wrote themselves.
When the SmartHire writeup lands
We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. SmartHire has retired, so the chain is clear to publish and the writeup goes up in the same format as the HTB Forgotten one.
The team’s internal notes still go out in our Discord first. That’s also where people work through the boxes that are still active together.
Related writeups
Retired Linux boxes we’ve already published: