fix Windows arm64 WireGuard reconnects

Author: moloch--

implant/sliver/transports/wireguard/bind_default.go

@@ -0,0 +1,9 @@
+//go:build (windows && !arm64) || darwin || linux
+
+package wireguard
+
+import "golang.zx2c4.com/wireguard/conn"
+
+func newWGUDPBind() conn.Bind {
+	return conn.NewDefaultBind()
+}

implant/sliver/transports/wireguard/bind_windows_arm64.go

@@ -0,0 +1,12 @@
+//go:build windows && arm64
+
+package wireguard
+
+import "golang.zx2c4.com/wireguard/conn"
+
+// WinRingBind can stop exchanging handshakes after rapid userspace-device
+// recreation on Windows ARM64. Beacon callbacks recreate their device at each
+// interval, so use wireguard-go's portable socket bind on this target.
+func newWGUDPBind() conn.Bind {
+	return conn.NewStdNetBind()
+}

implant/sliver/transports/wireguard/bind_windows_arm64_test.go

@@ -0,0 +1,15 @@
+//go:build windows && arm64
+
+package wireguard
+
+import (
+	"testing"
+
+	"golang.zx2c4.com/wireguard/conn"
+)
+
+func TestWindowsARM64WGUDPBindUsesStandardSockets(t *testing.T) {
+	if _, ok := newWGUDPBind().(*conn.StdNetBind); !ok {
+		t.Fatal("Windows ARM64 WireGuard bind did not use standard sockets")
+	}
+}

implant/sliver/transports/wireguard/wireguard.go

@@ -48,7 +48,6 @@ import (
 
 	"github.com/bishopfox/sliver/implant/sliver/netstack"
 	"golang.org/x/crypto/blake2b"
-	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun"
 	"google.golang.org/protobuf/proto"
@@ -375,7 +374,7 @@ func bringUpWGInterface(address string, port uint16, implantPrivKey string, serv
 	wgLogLevel = device.LogLevelVerbose
 	// {{end}}
 
-	dev := device.NewDevice(tun, conn.NewDefaultBind(), device.NewLogger(wgLogLevel, "[c2/wg] "))
+	dev := device.NewDevice(tun, newWGUDPBind(), device.NewLogger(wgLogLevel, "[c2/wg] "))
 	wgConf := bytes.NewBuffer(nil)
 	fmt.Fprintf(wgConf, "private_key=%s\n", implantPrivKey)
 	fmt.Fprintf(wgConf, "public_key=%s\n", serverPubKey)

server/c2/wireguard.go

@@ -41,7 +41,6 @@ import (
 	"github.com/bishopfox/sliver/server/netstack"
 	"github.com/bishopfox/sliver/util/minisign"
 	"github.com/hashicorp/yamux"
-	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"google.golang.org/protobuf/proto"
 )
@@ -108,7 +107,7 @@ func StartWGListener(port uint16, netstackPort uint16, keyExchangeListenPort uin
 	// Set this to device.LogLevelVerbose when debugging for verbose logs
 	// We should probably set this to LogLevelError and figure out how to
 	// redirect the logs from stdout
-	dev := device.NewDevice(tun, conn.NewDefaultBind(), device.NewLogger(device.LogLevelSilent, "[c2/wg] "))
+	dev := device.NewDevice(tun, newWGUDPBind(), device.NewLogger(device.LogLevelSilent, "[c2/wg] "))
 
 	wgConf := bytes.NewBuffer(nil)
 	fmt.Fprintf(wgConf, "private_key=%s\n", privateKey)

server/c2/wireguard_bind_default.go

@@ -0,0 +1,9 @@
+//go:build !windows || !arm64
+
+package c2
+
+import "golang.zx2c4.com/wireguard/conn"
+
+func newWGUDPBind() conn.Bind {
+	return conn.NewDefaultBind()
+}

server/c2/wireguard_bind_windows_arm64.go

@@ -0,0 +1,11 @@
+//go:build windows && arm64
+
+package c2
+
+import "golang.zx2c4.com/wireguard/conn"
+
+// Use the portable socket bind on Windows ARM64 so the listener continues to
+// accept handshakes when short-lived beacon devices change their UDP endpoint.
+func newWGUDPBind() conn.Bind {
+	return conn.NewStdNetBind()
+}

server/c2/wireguard_bind_windows_arm64_test.go

@@ -0,0 +1,15 @@
+//go:build windows && arm64
+
+package c2
+
+import (
+	"testing"
+
+	"golang.zx2c4.com/wireguard/conn"
+)
+
+func TestWindowsARM64WGUDPBindUsesStandardSockets(t *testing.T) {
+	if _, ok := newWGUDPBind().(*conn.StdNetBind); !ok {
+		t.Fatal("Windows ARM64 WireGuard bind did not use standard sockets")
+	}
+}