rasta-mouse / Watson

Enumerate missing KBs and suggest exploits for useful Privilege Escalation vulnerabilities

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Missing DLL on win <= 6.3.9600

yaap7 opened this issue · comments

commented

The execution of Watson.exe without any argument shows an error suggesting missing files:

PS C:\> .\Watson.Exe
  __    __      _
 / / /\ \ \__ _| |_ ___  ___  _ __
 \ \/  \/ / _` | __/ __|/ _ \| '_ \
  \  /\  / (_| | |_\__ \ (_) | | | |
   \/  \/ \__,_|\__|___/\___/|_| |_|

                           v0.1

                  Sherlock sucks...
                   @_RastaMouse

 [*] OS Build number: 7601
 [*] CPU Address Width: 64
 [*] Process IntPtr Size: 8
 [*] Using Windows path: C:\WINDOWS\System32

 [*] Finished. Sorry, found 0 vulns :(
ERROR> C:\WINDOWS\System32\win32kfull.sys
ERROR> C:\WINDOWS\System32\gdiplus.dll
ERROR> C:\WINDOWS\System32\coremessaging.dll

Actually, this files are missing on this system.

Tested on Windows 7 SP1 64 bits (6.1.7601):

ERROR> C:\WINDOWS\System32\win32kfull.sys
ERROR> C:\WINDOWS\System32\gdiplus.dll
ERROR> C:\WINDOWS\System32\coremessaging.dll

Tested on Windows Server 2012 R2 Standard 64 bits (6.3.9600):

ERROR> C:\WINDOWS\System32\win32kfull.sys
ERROR> C:\WINDOWS\System32\pcadm.dll
ERROR> C:\WINDOWS\System32\coremessaging.dll

(Note: the second lines are different.)

Work great on Windows 10 64 bits up-to-date.

Do you confirm that Watson only work on Win10+ and Win2016+?

No, it's just because not all versions of Windows have those particular files. I think those ones are only found on W10/2K16, and therefore are not on 7 etc. It doesn't mean it's not working properly on those other operating systems, it just won't find those particular vulnerabilities.

If you don't like seeing the errors, you can remove this line.

commented

Ok, I though these errors generate an incorrect behavior, biasing the whole execution.
If it is just some checks which are not done, it is not an issue.

Thanks for your quick explanation.