Challenge / AI-ML

Lost In Hyperspace

By Jennofrie Daguil · Cybersecurity and Red Team Operator

Lost In Hyperspace is a sanitized challenge note from the local HTB archive, organized for quick review by category, difficulty, evidence flow, and reusable operator

MediumPublished 2024-01-11Sanitized local writeup

Scenario

Lost In Hyperspace attack path

Lost In Hyperspace is a sanitized challenge note from the local HTB archive, organized for quick review by category, difficulty, evidence flow, and reusable operator

Objective

Challenge walkthrough focused on AI-ML evidence, validation, and reusable operator lessons.

Lost In Hyperspace sanitized attack graph

Walkthrough flow

Artifact review

Hypothesis

Validated solve path

Proof captured

Source coverage

High source coverage

Status: complete. This article is generated from 4 sanitized Markdown sources and keeps raw flags, credentials, keys, cookies, and reusable secrets out of the rendered blog.

89% coverage

Evidence verdict

Good confidence: the page has enough source material to read as a complete walkthrough, but the supporting evidence set is smaller than the highest-confidence cases.

AI-ML/Lost-in-Hyperspace/writeup.md
htb-challenge/AI-ML/Lost-in-Hyperspace/notes.md
htb-challenge/AI-ML/Lost-in-Hyperspace/memory-summary.md
htb-challenge/AI-ML/Lost-in-Hyperspace/hypothesis-board.md

Technical Walkthrough

Writeup

Challenge

Name: Lost-in-Hyperspace
Category: AI-ML
Difficulty: Medium
Mode: file

Summary

The challenge provides character tokens and 512-dimensional embeddings. The hint points to shadows/projections, and PCA confirms that the embeddings are dominated by two principal components. Treating those two components as a recovered 2D shadow and traversing nearby points reveals a coherent HTB-format flag substring.

Artifact Inventory

Relevant artifacts:

files/a12c7399-5407-4af8-8b9d-681daea57e56.zip: original HTB archive, preserved unmodified.
files/extracted/token_embeddings.npz: NumPy archive with tokens and embeddings.
analysis/plots/pca_1_2.png: labeled view of the dominant 2D projection.
analysis/pca-nearest-neighbor.md: local analysis notes.
solve/solve.py: reproducible solver.

Analysis

The .npz file contains:

tokens: 110 one-character strings.
embeddings: a 110 x 512 float matrix.

The raw token order is noisy and does not form the flag. SVD/PCA on the centered embedding matrix showed that the first two components explain about 82.8% of the variance. That strongly suggests the 512D embeddings are a high-dimensional projection of a lower-dimensional layout, matching the challenge clue about shadows.

Using the first two principal components as coordinates, a greedy nearest-neighbor traversal from every possible start was tested. Several malformed flag-shaped substrings can appear in long traversals, so the solver selects the unique candidate consistent with the challenge title and recovered text fragments: it must contain L0ST, _1N_, TH3, and SP1R4L.

Solve

Run:

bash

cd <local workspace>
python3 AI-ML/Lost-in-Hyperspace/solve/solve.py
python3 scripts/challenge_harness.py capture-flag AI-ML/Lost-in-Hyperspace --from analysis/flag-candidate.txt
rm -f AI-ML/Lost-in-Hyperspace/analysis/flag-candidate.txt

The solve script:

Loads token_embeddings.npz.
Centers the embedding matrix.
Computes PCA with NumPy SVD.
Keeps the first two principal components as the 2D shadow.
Runs nearest-neighbor traversal from every starting point.
Extracts and scores HTB-format candidates.
Writes the raw candidate to analysis/flag-candidate.txt for harness capture and writes a redacted path preview to analysis/nearest-neighbor-path.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

High-dimensional embeddings can hide low-dimensional geometric structure.
Before trying heavier ML tooling, inspect variance and rank; simple PCA solved this challenge.
Greedy paths may produce false-positive flag-shaped substrings, so candidate selection needs a validation rule tied to the challenge evidence.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

Challenge: Lost-in-Hyperspace
Category: AI-ML
Difficulty: Medium
Mode: file
Remote instance: none
Start time: 2026-06-12T12:44:21Z
Operator: harness
State file: challenge-state.json

Harness Status

Current phase: see challenge-state.json
Next allowed actions: see next-action.json
Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

File	Size	SHA256	Type	Notes
`files/a12c7399-5407-4af8-8b9d-681daea57e56.zip`	431710	`<hash redacted>`	Zip archive data, at least v2.0 to extract, compression method=deflate	zip entries: 1 shown in artifact inventory JSON
`files/extracted/token_embeddings.npz`	451518	`<hash redacted>`	Zip archive data, at least v4.5 to extract, compression method=store

Evidence Ledger

Time	Action	Output/File	Finding	Confidence	Next
2026-06-12T12:44:21Z	harness init	`challenge-state.json`	Workspace initialized with deterministic state file	High	Inventory artifacts
2026-06-12T12:44:47Z	artifact inventory	`analysis/artifact-inventory.json`	2 artifact(s) inventoried	High	Build or update hypotheses
2026-06-12T12:45:18Z	hypothesis recorded	`hypothesis-board.md`	Recover hidden text by projecting 512D token embeddings into a lower-dimensional shadow and ordering visible character points	Medium	Run PCA/SVD and distance analysis, plot labeled points, and test whether token order or projected spatial order yields HTB-format text.
2026-06-12T12:45:18Z	research skip	`analysis/research/research-skip.md`	Research intentionally skipped with recorded reason	Medium	Gate before exploit
2026-06-12T12:50:16Z	instrumentation plan	`analysis/instrumentation-plan.md`	Recover the hidden flag from token_embeddings.npz by reducing the 512D embeddings into their dominant low-dimensional shadow and extracting the coherent token path.	High	Stop if more than one candidate appears, no HTB-format substring appears, or the candidate cannot be reproduced from the artifact alone.
2026-06-12T12:50:17Z	checkpoint recorded	`analysis/checkpoint-analysis-20260612T125017020720Z-0b5a2475.md`	Checkpoint for ANALYSIS	High	Use checkpoint to drive next decision
2026-06-12T12:51:44Z	flag capture	`loot/flag.txt`	HTB-format flag captured; raw value kept in loot only	High	Write solution and run completion gate
2026-06-12T12:53:11Z	completion gate	`challenge-state.json`	Completion gate passed; state marked COMPLETE	High	Optional sanitized memory summary approval

Key Findings

token_embeddings.npz contains tokens and embeddings, with shape (110,) and (110, 512).
First two PCA components explain about 82.8% of embedding variance.
Greedy nearest-neighbor traversal over the recovered 2D shadow reveals a clue-consistent HTB-format flag substring.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

bash

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

Platform: HackTheBox Challenges
Category: AI-ML
Challenge: Lost-in-Hyperspace
Difficulty: Medium
Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

Reusable Lessons

Dead Ends

Tool Quirks

Evidence Paths

Ingestion Decision

Proposed for LightRAG: yes/no
Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Rank	Path	Evidence	Missing Proof	Cheapest Validation	Confidence	Status
1	Recover hidden text by projecting 512D token embeddings into a lower-dimensional shadow and ordering visible character points	Artifact contains single-character tokens plus 512-dimensional float embeddings; scenario explicitly references shadows of higher-dimensional objects.	Need identify the projection/order that makes the token characters form an HTB{...} flag.	Run PCA/SVD and distance analysis, plot labeled points, and test whether token order or projected spatial order yields HTB-format text.	Medium	active

Closed Branches

Branch	Evidence Tested	Failure Output	Reason Closed	Revisit Condition

Technical analogy

How to remember this solve

Think of the challenge as a small system with one rule that matters more than the rest. The solve is finding that rule, validating it, and using it carefully enough to reach the final proof.

For Lost In Hyperspace, keep the mental model simple: identify the trusted assumption, prove it with the smallest safe test, then automate or repeat only the part that directly leads to the flag.

Lost In Hyperspace

Lost In Hyperspace attack path

High source coverage

Technical Walkthrough

Writeup

Challenge

Summary

Artifact Inventory

Analysis

Solve

Flag

Lessons

Source-Backed Dossier

Notes

Scope

Harness Status

Artifact Inventory

Evidence Ledger

Key Findings

RAG / Advisory Memory

Secrets/Flags

Memory Summary

Metadata

Validated Solve Chain

Reusable Lessons

Dead Ends

Tool Quirks

Evidence Paths

Ingestion Decision

Hypothesis Board

Closed Branches

How to remember this solve

Related insights