Hack The Box Touch Stats (Easy Windows)

Touch is week 2 of Hack The Box Season 12, an easy Windows machine by TheCyberGeek, worth 20 points and 585 XP. It went live at 19:00 UTC on 2026-10-03 and has been up for five weeks. What follows is the current data and a read of the difficulty. No chain, no flags.

HTB Touch at a glance

Machine ID	987
Difficulty	Easy (20 pts / 585 XP)
OS	Windows
Released	2026-10-03 (Season 12, week 2)
Status	active, five weeks live
Maker	TheCyberGeek
Rating	4.3 / 5 from 362 reviews
User owns	7,581
Root owns	5,793
User → root drop	23.6%
User blood	18m 27s by Knorrke
Root blood	36m 21s by admiin

Community difficulty votes:

Bucket	Votes	Share
Easy	1,585	30.7%
Too Easy	1,500	29.0%
Medium	831	16.1%
Very Easy	325	6.3%
Bit Hard	306	5.9%

Total votes: 5,165.

Touch starts where Layover ended

Touch picks up where Layover left off. HTB’s machine page hands every player a name and a booking confirmation code “uncovered in the Layover machine” before the box even boots. In practice that means you do not start from nothing: you start holding something that looks like an identity, and the first question is which service on a Windows host will accept it. You do not need to have solved Layover to use them, since HTB prints both on Touch’s own page.

Is HTB Touch hard?

Getting in, no. Root is a different question.

The votes back the label. 3,612 of 5,165 land below Medium, 69.9%, against 722 above it. Weighted across the ten buckets Touch scores 40.6 out of 100, third of the six Easies on the live board, which run from 33.0 on Connected to 42.3 on Management.

The drop does not. 1,788 of the 7,581 players who took user have not taken root, 23.6%, the widest user-to-root drop on the whole live board, ahead of Connected at 18.9%. The other five Easies run from 3.8% to 18.9%.

The bloods point the same way. Knorrke took user in 18m27s and admiin took root in 36m21s, 17m54s later. Both are the slowest bloods of any Easy currently live: every other Easy fell to user inside 7m10s and to root inside 18m05s.

So read the label as a statement about the foothold. Once you are in, roughly one player in four stops short of root, which is not what an Easy usually asks.

It is still well liked. 4.3 from 362 reviews is second among the live Easies, behind Enigma’s 4.4, and Touch is the only Easy Windows box on the board.

TheCyberGeek is a Hack The Box moderator and Touch is the 36th machine on their profile, a long catalogue by any measure. Most of that catalogue is Linux. Touch is only the fifth Windows box among the 36, after Cerberus, Crafty, Mailing and MonitorsFour, and three of those four were Easy as well.

We have written up several of their retired Linux machines, including Postman, GoodGames, Broker and Runner, and three of their boxes are still live with briefs of their own: Cohort, Nimbus and Management. Postman and Broker, both Easy, fell to a real product running a known-vulnerable version, so read version strings carefully.

What to have ready for Touch

• Full TCP sweep first. On Windows the port list tells you the shape of the box: 88, 389 and 445 together mean a domain controller, 5985 means WinRM is a way in once you hold a password.
• Test anything you are given everywhere it could apply: SMB, LDAP, WinRM, MSSQL and any web login. nxc against each protocol is the fastest way to find where a credential works.
• If it is a domain, enumerate it as soon as something authenticates: users, groups, shares and SPNs, then BloodHound. On an Easy the path is usually short and visible in the graph.
• Read every share you can open. Configuration files, scripts and old backups are where Easy Windows boxes leave the next password.
• Privesc: whoami /all before anything else. Token privileges and group membership decide most Easy Windows roots, then services, scheduled tasks and stored credentials. Do not budget an Easy’s ten minutes for it: the 23.6% drop says this is where Touch spends its difficulty.

When the Touch writeup lands

We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Touch is still live, so the writeup goes up the week it retires, in the same format as the HTB Cicada one.

If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Touch is still live.

Related writeups

Retired easy Windows boxes we’ve already published:

• Hack The Box Cicada Writeup
• Hack The Box Support Writeup
• Hack The Box Return Writeup