Hack The Box Takeoff Stats (Hard Linux)

Takeoff is week 6 of Hack The Box Season 12, a hard Linux machine by ctrlzero, worth 40 points and 1,105 XP. It went live at 19:00 UTC on 2026-10-31 and has been up for nine days. What follows is the current data and a read of the difficulty. No chain, no flags.

HTB Takeoff at a glance

Machine ID	1002
Difficulty	Hard (40 pts / 1,105 XP)
OS	Linux
Released	2026-10-31 (Season 12, week 6)
Status	active, nine days live
Maker	ctrlzero
Rating	4.5 / 5 from 127 reviews
User owns	2,243
Root owns	2,213
User → root drop	1.3%
User blood	9m 35s by DarkCaT
Root blood	10m 56s by DarkCaT

Community difficulty votes:

Bucket	Votes	Share
Hard	369	27.0%
Medium	227	16.6%
Bit Hard	197	14.4%
Too Hard	163	11.9%
Easy	110	8.0%

Total votes: 1,369.

Is HTB Takeoff hard?

Getting in is. Getting root, by the numbers, is not.

The votes put it where the label does. Hard is the largest bucket at 27.0%, and 654 of 1,369 votes, 47.8%, land on Hard or above. Weighted across the ten buckets it scores 60.0 out of 100, third of the four Hards on the live board: DarkZeroReturns leads at 77.1 and Nimbus sits at 62.2, with Scaffold just behind at 59.0. This is an honest Hard, not one of the Hards that play like an Insane.

The drop is the striking number. 2,213 of the 2,243 players who took user also hold root, a 1.3% drop, 30 people in all. That is the smallest drop on the whole live board, below DutyBound’s 1.7%, and the other three Hards run from 8.2% to 18.1%. DarkCaT took both bloods, user in 9m35s and root in 10m56s, 1m21s apart.

So the difficulty sits in the foothold. Whatever stops people on Takeoff stops them before user; once you are in, root follows almost every time.

Nine days in it already has 2,243 user owns, 68 fewer than DarkZeroReturns has collected since July. 4.5 from 127 reviews ties Nimbus as the second-best-rated Hard on the board, behind DarkZeroReturns’ 4.7.

The name follows the season’s run of aviation words after Layover and Autopilot. Takeoff is the 14th machine on ctrlzero’s profile and the third in a row, after TrustFall, built with EmSec, and Autopilot, both Insane Windows. All three are live and all three rate 4.5 or better. Most of ctrlzero’s catalogue is Windows. Takeoff is only their fifth Linux box, after Bolt, Carpediem, Snoopy and Skyfall, and two of those four were Hard as well. Snoopy and Skyfall are both written up here, and they are the closest preview we have of how this maker builds a Linux chain.

What to have ready for Takeoff

• Full TCP sweep and the top UDP ports before you touch anything. On a Hard the second service is usually the one that matters.
• Enumerate every vhost and subdomain, and read every response header. A Hard foothold is rarely on the first page you load.
• Expect to chain two or three bugs, none of which is enough alone. Write each primitive down the moment you find it, even when it looks useless.
• Have a container and internal-network checklist ready: /.dockerenv, mounted sockets, internal-only ports reachable with chisel or ligolo-ng.
• Privesc: enumerate as every user you land on. Custom binaries, cron jobs and anything in /opt deserve a read, not a glance. A 1.3% drop says root is close to wherever you land.

When the Takeoff writeup lands

We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Takeoff is still live, so the writeup goes up the week it retires, in the same format as the HTB Snoopy one.

If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Takeoff is still live.

Related writeups

Retired hard Linux boxes we’ve already published:

• Hack The Box Snoopy Writeup
• Hack The Box Gofer Writeup
• Hack The Box Registry Writeup