E-WAT
Watson
Enumerates missing Windows patches and suggests matching known privilege-escalation exploits.
OVERVIEW
Watson enumerates the installed Windows updates (KBs) and OS build on a target, then cross-references what's missing against a curated list of known local privilege-escalation vulnerabilities, reporting which public exploits are likely to apply given the host's actual patch level.
It's a companion to the author's earlier Sherlock script but rewritten in C#, and is built to avoid false positives by checking hotfix and build-level detail rather than relying on version banners alone.
USE CASES
Practical use cases
- 01
Getting a quick, patch-level-accurate shortlist of known privesc exploits after landing a shell.
- 02
Prioritizing which public exploit to try first instead of testing every known CVE against the host.
- 03
Confirming a host is actually missing a patch before reporting it as a finding.
- 04
Cross-checking a client's patch-management claims against what's actually installed.
QUICK START
On a Windows host with a shell already established, to check patch level and get a short list of known local privilege-escalation exploits worth trying.
- Get an initial shell (any privilege level) on the target Windows host.
- Transfer the Watson binary to the target or run it in memory if scope allows.
- Run it with no arguments to enumerate KBs and list matching known exploits.
- Validate the top candidate exploit manually before relying on the suggestion.
Watson.exeBEFORE YOU RUN IT
What to check before running it
The repository is archived and no longer updated, so its exploit database won't reflect vulnerabilities disclosed after that point — cross-check findings against current advisories.
It only reports what's missing based on known KBs; a fully patched host with a zero-day or logic-based privesc path will show nothing.
Running an unsigned enumeration binary can itself be flagged by EDR — consider whether an in-memory execution method fits the engagement's constraints.