:( (sad_face)

Platform: scarlet | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-01-11 | Status: Solved Techniques: evtx_parsing, base64_double_decode, event_log_analysis, binary_data_extraction

Summary

Files provided: sad_face.zip containing Challenge.evtx

:( (sad_face) — Scarlet CTF

Description

As I look back at my RUSEC memories, I remembered the time that I met my mentor! Seems like he accidently kept sending my machine a payload that made my screen go blue...

Files provided: sad_face.zip containing Challenge.evtx

Analysis

The challenge provides a Windows Event Log file (.evtx). The description hints at:

• BSOD (Blue Screen of Death) - "screen go blue"
• EternalBlue exploit - "payload that made my screen go blue" + mentor sending payloads
• Sad face - The :( shown on Windows BSOD screens ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 1: Parse the EVTX file

Used python-evtx library to parse the Windows Event Log:

 python read-only • copy allowed Copy
from Evtx.Evtx import Evtx

with Evtx("Challenge.evtx") as evtx:
    for record in evtx.records():
        xml = record.xml()
        print(xml)

Step 2: Identify relevant events

Searched for BSOD-related events:

• EventID 1001 - BugCheck events ("The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b")
• EventID 41 - Unexpected system reboot (kernel power)

These events contained <Binary> fields with Base64-encoded data. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Extract and decode Binary data

The data was double-encoded - Base64 inside Base64:

 python read-only • copy allowed Copy
from Evtx.Evtx import Evtx
import base64

with Evtx("Challenge.evtx") as evtx:
    for record in evtx.records():
        xml = record.xml()
        if '<Binary>' in xml and '</Binary>' in xml:
            start = xml.find('<Binary>') + len('<Binary>')
            end = xml.find('</Binary>')
            binary_data = xml[start:end].strip()
            if binary_data:
                try:
                    decoded1 = base64.b64decode(binary_data)
                    decoded2 = base64.b64decode(decoded1)
                    text = decoded2.decode('utf-8', errors='ignore')
                    if text and text.isprintable():
                        print(f"Record {record.record_num()}: {text}")
                except:
                    pass

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Reconstruct the flag

Found 3 flag parts across different event records:

Solution

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Scarlet CTF - :( (sad_face) Solver
Extracts flag from double-Base64 encoded data in Windows Event Log
"""

from Evtx.Evtx import Evtx
import base64

def solve(evtx_path):
    flag_parts = []
    
    with Evtx(evtx_path) as evtx:
        for record in evtx.records():
            xml = record.xml()
            
            # Extract Binary field content
            if '<Binary>' in xml and '</Binary>' in xml:
                start = xml.find('<Binary>') + len('<Binary>')
                end = xml.find('</Binary>')
                binary_data = xml[start:end].strip()
                
                if binary_data:
                    try:
                        # Double Base64 decode
                        decoded1 = base64.b64decode(binary_data)
                        decoded2 = base64.b64decode(decoded1)
                        text = decoded2.decode('utf-8', errors='ignore')
                        
                        # Check for flag-like content
                        if text and ('RUSEC' in text or text.isprintable()):
                            print(f"Record {record.record_num()}: {repr(text)}")
                            if text.strip():
                                flag_parts.append((record.record_num(), text))
                    except Exception as e:
                        pass
    
    # Sort by record number and combine
    flag_parts.sort(key=lambda x: x[0])
    flag = ''.join(part[1] for part in flag_parts)
    print(f"\nFlag: {flag}")
    return flag
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

if __name__ == "__main__":
    solve("Challenge.evtx")

Background: EternalBlue

The challenge references EternalBlue (MS17-010), a famous vulnerability in Microsoft's SMBv1 protocol:

• Leaked by Shadow Brokers in 2017
• Used in WannaCry and NotPetya ransomware attacks
• Caused BSOD on vulnerable Windows systems when exploited incorrectly
• The "sad face" :( is the emoticon shown on Windows 8+ BSOD screens

Flag breakdown:

• REDACTED - EternalBlue exploit
• s@d_fac3 - The :( on BSOD screens
• smbv1 - SMBv1 protocol exploited by EternalBlue
• 3890cn2k29 - Random identifier ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍