Like A Glove
Like A Glove is a sanitized challenge note from the local HTB archive, organized for quick review by category, difficulty, evidence flow, and reusable operator
Scenario
Like A Glove attack path
Like A Glove is a sanitized challenge note from the local HTB archive, organized for quick review by category, difficulty, evidence flow, and reusable operator
Objective
Challenge walkthrough focused on AI-ML evidence, validation, and reusable operator lessons.
Walkthrough flow
Artifact review
Hypothesis
Validated solve path
Proof captured
Source coverage
High source coverage
Status: complete. This article is generated from 6 sanitized Markdown sources and keeps raw flags, credentials, keys, cookies, and reusable secrets out of the rendered blog.
High confidence: the page is reconstructed from a primary walkthrough plus multiple supporting notes or evidence sources. Treat the chain as source-backed, while still checking the listed source files for sensitive values.
- AI-ML/Like-a-Glove/writeup.md
- htb-challenge/AI-ML/Like-a-Glove/notes.md
- htb-challenge/AI-ML/Like-a-Glove/memory-summary.md
- htb-challenge/AI-ML/Like-a-Glove/hypothesis-board.md
- HTB/_knowledge/exports/ctf-lightrag-latest-203412/documents/challenge__AI-ML__Like-a-Glove__memory-summary.md.a59ae907e1.md
- HTB/_knowledge/exports/ctf-lightrag-latest-203412/documents/challenge__AI-ML__Like-a-Glove__notes.md.b6272dd11c.md
Technical Walkthrough
Writeup
Challenge
- Name: Like-a-Glove
- Category: AI-ML
- Difficulty: Easy
- Mode: file
Summary
The challenge provides analogy prompts generated against the glove-twitter-25 embedding space. Each row is decoded by computing the direct analogy vector mapped - source + prompt, finding the nearest vocabulary token, concatenating all tokens, and applying Unicode NFKC normalization. The decoded model stream starts with lowercase htb{, matching the challenge statement.
Artifact Inventory
files/a12c739d-9ede-40c5-a4a1-3d79833cab7d.zip: <password redacted> challenge archive.files/extracted/chal.txt: 84 analogy rows in the formatLike A is to B, C is to?.analysis/artifact-inventory.json: artifact hash, size, and archive listing.analysis/research/glove-method-validation.md: advisory method notes plus local validation.
Analysis
The challenge text names glove-twitter-25 and says the output should be ASCII and begin with htb{. All tokens in chal.txt exist in the loaded Gensim GloVe vocabulary, so no token repair or alternate embedding model was needed.
Two nearby approaches were tested. most_similar(positive=[mapped, prompt], negative=[source]) produced a noisy token stream and was rejected for this artifact. Direct vector lookup with similar_by_vector(model[mapped] - model[source] + model[prompt]) produced a consistent stream that began with the expected prefix and ended with a closing brace after normalization.
The raw nearest-neighbor stream contains full-width digits and symbols. Applying unicodedata.normalize("NFKC", ...) converts those compatibility characters into ASCII, producing the final HTB-format value.
Solve
Run:
AI-ML/Like-a-Glove/.venv/bin/python AI-ML/Like-a-Glove/solve/solve.py --output AI-ML/Like-a-Glove/loot/flag-candidate.txt
./scripts/challenge_harness.py capture-flag AI-ML/Like-a-Glove --from loot/flag-candidate.txtThe solver loads glove-twitter-25, parses each analogy row, calculates the direct vector expression, resolves the nearest vocabulary token, normalizes the joined output with NFKC, and writes the decoded value to the requested output path.
Flag
Raw flag is stored in loot/flag.txt and intentionally not reproduced here.
Lessons
For embedding challenges, the library API choice can materially change the answer. Here, direct nearest-neighbor lookup from an explicitly computed vector was the correct reproduction path; the convenience analogy API produced a misleading result. Unicode compatibility normalization also matters because GloVe Twitter includes many full-width and non-English tokens that can encode ASCII-looking content.
Source-Backed Dossier
The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.
Notes
Scope
- Challenge: Like-a-Glove
- Category: AI-ML
- Difficulty: Easy
- Mode: file
- Remote instance: none
- Start time: 2026-06-09T06:28:51Z
- Operator: harness
- State file:
challenge-state.json
Harness Status
- Current phase: see
challenge-state.json - Next allowed actions: see
next-action.json - Raw flags and sensitive material stay in
loot/only. Do not paste them here.
Artifact Inventory
| File | Size | SHA256 | Type | Notes |
|---|---|---|---|---|
files/a12c739d-9ede-40c5-a4a1-3d79833cab7d.zip | 1810 | <hash redacted> | Zip archive data, at least v2.0 to extract, compression method=deflate | zip entries: 1 shown in artifact inventory JSON |
Evidence Ledger
| Time | Action | Output/File | Finding | Confidence | Next |
|---|---|---|---|---|---|
| 2026-06-09T06:28:51Z | harness init | challenge-state.json | Workspace initialized with deterministic state file | High | Inventory artifacts |
| 2026-06-09T06:28:51Z | artifact inventory | analysis/artifact-inventory.json | 1 artifact(s) inventoried | High | Build or update hypotheses |
| 2026-06-09T06:29:15Z | hypothesis recorded | hypothesis-board.md | Decode metaphorical AI conversation by mapping clues through glove-twitter-25 embedding nearest-neighbor/analogy relationships. | Medium | Inspect extracted files for word pairs/clues, then use a local or lightweight GloVe-twitter-25 lookup to resolve intended ASCII flag tokens. |
| 2026-06-09T06:29:15Z | research task | analysis/research/task-20260609T062915066020Z-01b861cf.md | Research task created for advisory investigation | Medium | Record research output |
| 2026-06-09T06:41:00Z | research record | analysis/research/research-records.md | Research tagged MATCHED | Medium | Validate against current evidence |
| 2026-06-09T06:41:19Z | flag capture | loot/flag.txt | HTB-format flag captured; raw value kept in loot only | High | Write solution and run completion gate |
| 2026-06-09T06:42:01Z | completion gate | challenge-state.json | Completion gate passed; state marked COMPLETE | High | Optional sanitized memory summary approval |
| 2026-06-09T06:47:09Z | flag capture | loot/flag.txt | HTB-format flag captured; raw value kept in loot only | High | Write solution and run completion gate |
| 2026-06-09T06:47:09Z | completion gate | challenge-state.json | Completion gate passed; state marked COMPLETE | High | Optional sanitized memory summary approval |
Key Findings
-
RAG / Advisory Memory
RAG output is advisory only. Record evaluated retrievals with:
scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."Secrets/Flags
Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.
Memory Summary
Metadata
- Platform: HackTheBox Challenges
- Category: AI-ML
- Challenge: Like-a-Glove
- Difficulty: Easy
- Source workspace:
<local workspace>
Validated Solve Chain
Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.
1.
Reusable Lessons
-
Dead Ends
-
Tool Quirks
-
Evidence Paths
-
Ingestion Decision
- Proposed for LightRAG: yes/no
- Requires user approval before ingestion: yes
Hypothesis Board
Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.
| Rank | Path | Evidence | Missing Proof | Cheapest Validation | Confidence | Status |
|---|---|---|---|---|---|---|
| 1 | Decode metaphorical AI conversation by mapping clues through glove-twitter-25 embedding nearest-neighbor/analogy relationships. | Challenge description names glove-twitter-25 and says flag starts with htb{ ASCII. | Inspect extracted files for word pairs/clues, then use a local or lightweight GloVe-twitter-25 lookup to resolve intended ASCII flag tokens. | Medium | Active |
Closed Branches
| Branch | Evidence Tested | Failure Output | Reason Closed | Revisit Condition |
|---|
Memory Summary
approval_required: true
Sanitized Memory Summary
Metadata
- Platform: HackTheBox Challenges
- Category: AI-ML
- Challenge: Like-a-Glove
- Difficulty: Easy
- Source workspace:
<local workspace>
Validated Solve Chain
Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.
1.
Reusable Lessons
-
Dead Ends
-
Tool Quirks
-
Evidence Paths
-
Ingestion Decision
- Proposed for LightRAG: yes/no
- Requires user approval before ingestion: yes
Notes
Notes
Scope
- Challenge: Like-a-Glove
- Category: AI-ML
- Difficulty: Easy
- Mode: file
- Remote instance: none
- Start time: 2026-06-09T06:28:51Z
- Operator: harness
- State file:
challenge-state.json
Harness Status
- Current phase: see
challenge-state.json - Next allowed actions: see
next-action.json - Raw flags and sensitive material stay in
loot/only. Do not paste them here.
Artifact Inventory
| File | Size | SHA256 | Type | Notes |
|---|---|---|---|---|
files/a12c739d-9ede-40c5-a4a1-3d79833cab7d.zip | 1810 | <hash redacted> | Zip archive data, at least v2.0 to extract, compression method=deflate | zip entries: 1 shown in artifact inventory JSON |
Evidence Ledger
| Time | Action | Output/File | Finding | Confidence | Next |
|---|---|---|---|---|---|
| 2026-06-09T06:28:51Z | harness init | challenge-state.json | Workspace initialized with deterministic state file | High | Inventory artifacts |
| 2026-06-09T06:28:51Z | artifact inventory | analysis/artifact-inventory.json | 1 artifact(s) inventoried | High | Build or update hypotheses |
| 2026-06-09T06: <REDACTED>, then use a local or lightweight GloVe-twitter-25 lookup to resolve intended ASCII flag tokens. | |||||
| 2026-06-09T06:29:15Z | research task | analysis/research/task-20260609T062915066020Z-01b861cf.md | Research task created for advisory investigation | Medium | Record research output |
| 2026-06-09T06:41:00Z | research record | analysis/research/research-records.md | Research tagged MATCHED | Medium | Validate against current evidence |
| 2026-06-09T06: <REDACTED> | |||||
| 2026-06-09T06:42:01Z | completion gate | challenge-state.json | Completion gate passed; state marked COMPLETE | High | Optional sanitized memory summary approval |
| 2026-06-09T06: <REDACTED> | |||||
| 2026-06-09T06:47:09Z | completion gate | challenge-state.json | Completion gate passed; state marked COMPLETE | High | Optional sanitized memory summary approval |
Key Findings
-
RAG / Advisory Memory
RAG output is advisory only. Record evaluated retrievals with:
scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."Secrets/Flags
Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.
Technical analogy
How to remember this solve
Think of the challenge as a small system with one rule that matters more than the rest. The solve is finding that rule, validating it, and using it carefully enough to reach the final proof.
For Like A Glove, keep the mental model simple: identify the trusted assumption, prove it with the smallest safe test, then automate or repeat only the part that directly leads to the flag.