Tags: hybrid deadfacectf 

Rating:

DEADFACE talks about having a potential buyer for the database leak on Ghost Town. Figure out where they're keeping the wallet info for cryptocurrency transactions. Submit the flag as: flag{flag-goes-here}.

open https://ghosttown.deadface.io/
we found article named **Potential Buyer in the Works**

The string fkdgcbd7ctdqde5dhysmdgefrjs6ip2zjgiycx5vsdvtpdspmkhi5hid posted by d34th its weird string i try different way to decode it but nothing !

so i think i relevant to previous question Treats
so i add it to .onion to it
http:\\fkdgcbd7ctdqde5dhysmdgefrjs6ip2zjgiycx5vsdvtpdspmkhi5hid.onion
open it using tor browser

inspect element and go to debugger
inspect file named **haetg75d54a.js**

we found function named** grap**

have fetch data **aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L3FGZGVnWHRp**

the btoa method takes string and encode it with base64

to decode that using base64

https://www.base64decode.org/
i got link **https://pastebin.com/raw/qFdegXti**
open it we found the flag
**flag{Ogr3s_r_lik3_On1onS}**