Gone But Not Forgotten

Challenge:

It looks like DEADFACE members shared their public keys last month. All of them sent their keys over Signal or email except for spookyboi. He mentioned uploading his key to portal.deadface.io, but none of our analysts can get to the site. Submit the MD5 hash of the public key file as the flag.

Submit the flag as: flag{MD5_hash}.

Solution:

A quick search of GhostTown for portal.deadface.io returned a single thread named, "Need public keys". At the end of the thread spookyboi mentions uploading his key into the docs folder on portal.deadface.io.

We first verified that the site was unreachable (it would not resolve in DNS) so then tried a Google search for possible cached versions. Google had no results so our next step was archive.org a.k.a Wayback Machine.

A search for "portal.deadface.io/docs" produced a snapshot from Sept 5, 2022 which was a directory listing containing spookyboi's public key.

Clicking the link initiated the file download for spookyboi-public.pem which we then generated an MD5 hash for:

$ md5sum spookyboi-public.pem
5dd1e3ea3846dc7f951cd816842399e7  spookyboi-public.pem

The accepted flag was: flag{5dd1e3ea3846dc7f951cd816842399e7}