watson's Introduction

Watson

Watson is a (.NET 2.0 compliant) C# implementation of Sherlock.

Basic Usage

Ensure you use the correct .NET Framework version for your target system, as described here.

Run the exe from disk or via the execute-assembly functionality within Cobalt Strike, SILENTTRINITY etc.

beacon> execute-assembly C:\Users\Rasta\source\repos\Watson\Watson\bin\Debug\Watson.exe
[*] Tasked beacon to run .NET program: Watson.exe
[+] host called home, sent: 135211 bytes
[+] received output:
  __    __      _                   
 / / /\ \ \__ _| |_ ___  ___  _ __  
 \ \/  \/ / _` | __/ __|/ _ \| '_ \ 
  \  /\  / (_| | |_\__ \ (_) | | | |
   \/  \/ \__,_|\__|___/\___/|_| |_|
                                   
                           v0.1    
                                   
                  Sherlock sucks...
                   @_RastaMouse

 [*] OS Build number: 14393
 [*] CPU Address Width: 64
 [*] Processs IntPtr Size: 8
 [*] Using Windows path: C:\WINDOWS\System32

  [*] Appears vulnerable to CVE-2018-8897
   [>] Description: An EoP exists when the Windows kernel fails to properly handle objects in memory.
   [>] Exploit: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/mov_ss.rb
   [>] Notes: May not work on all hypervisors.

  [*] Appears vulnerable to CVE-2018-0952
   [>] Description: An EoP exists when Diagnostics Hub Standard Collector allows file creation in arbitrary locations. 
   [>] Exploit: https://www.exploit-db.com/exploits/45244/
   [>] Notes: None

  [*] Appears vulnerable to CVE-2018-8440
   [>] Description: An EoP exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
   [>] Exploit: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/alpc_taskscheduler.rb
   [>] Notes: None.

 [*] Finished. Found 3 vulns :)