Reverse WireGuard SOCKS Proxy

[Thomas-McKanna]

For the life of me, I have not been able to figure out how to get the wg-socks proxy to work.

Steps taken:

1. Generate an implant in Sliver with generate --wg 192.168.119.189 --os windows --arch 386 --save /tmp

2. Generate a configuration in Sliver with wg-config --save /home/kali/Desktop/wg.conf

3. Change config so that it looks like:

    [Interface]
    Address = 100.64.0.7/16
    ListenPort = 51902
    PrivateKey = yFbVP60svq9WpXMdFxGDWDMR4Co1N8uEbY1sEzHYL38=
    MTU = 1420
    
    [Peer]
    PublicKey = JGafwyK1yC1ynqUbwd3YxCpbQgDuAPBX3x/KYs86IEc=
    AllowedIPs = 100.64.0.0/16
    Endpoint = 192.168.119.189:53
   

4. Run wg-quick up /home/kali/wg.conf

5. Start listener in Sliver with wg

6. Open a session in Sliver by running implant binary on target

7. Use the session and run wg-socks start with response [*] Started SOCKS server on 100.64.0.27:3090

At this point, I believe I have followed the wiki article exactly.

Now how do I use this thing?

I have my proxychains configuration file set to:

[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5  100.64.0.27 3090

Running proxychains namp -sT 172.16.189.5, which is an IP that should be reachable from my implanted target, times out.

I was able to get the socks proxy to work with the socks5 command, but would like to be able to use wg-socks since it is more stable.

[moloch--]

This looks correct to me @rkervella thoughts?

[rkervella]

I think you need to start the wg listener first (before running wg-config). It's been a while since I've used that, I'd need to test again.

[rkervella]

Hm indeed can't seem to get this to work either. Sounds like a regression.

[rkervella]

Alright it was indeed a regression in 53afb01: when refactoring the server part of the netstask/tun interface, IP forwarding was removed from the server code, disabling any kind of communications from external entities to the tun interface. I just pushed a fix in #716 .