Lab 388 — ModelForge

hackadvisor

Task: AI model management platform with 'Import Model from URL' feature (SSRF) and internal ForgeEngine API on port 3001 with Ollama-style modelfile support. Solution: Chain SSRF to discover internal API, create a model with ADAPTER directive pointing to /root/flag.txt, then export the model to exfiltrate file contents.