Tags: hybrid deadfacectf
Rating:
DEADFACE talks about having a potential buyer for the database leak on Ghost Town. Figure out where they're keeping the wallet info for cryptocurrency transactions. Submit the flag as: flag{flag-goes-here}.
open https://ghosttown.deadface.io/
we found article named **Potential Buyer in the Works**
The string fkdgcbd7ctdqde5dhysmdgefrjs6ip2zjgiycx5vsdvtpdspmkhi5hid posted by d34th its weird string i try different way to decode it but nothing !
so i think i relevant to previous question Treats
so i add it to .onion to it
http:\\fkdgcbd7ctdqde5dhysmdgefrjs6ip2zjgiycx5vsdvtpdspmkhi5hid.onion
open it using tor browser
inspect element and go to debugger
inspect file named **haetg75d54a.js**
we found function named** grap**
have fetch data **aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L3FGZGVnWHRp**
the btoa method takes string and encode it with base64
to decode that using base64
https://www.base64decode.org/
i got link **https://pastebin.com/raw/qFdegXti**
open it we found the flag
**flag{Ogr3s_r_lik3_On1onS}**