How does wireguard work?

[rokups]

Hello,
Could anyone please describe in deeper detail how wireguard transport works? Things that interest me:

1. Does implant create tun device?
2. If yes, does that not allow exposing target network by adding some routes on machine running the server?
3. If yes, is there an option to not do that? Creating a device (be it on windows or unixes) leaves more room to be noticed. I may be wrong, but as i understand wireguard-go does have a capability to run purely in user mode in some capacity.
4. I suppose since implant back-connects through wg, it exposes machine implant run's on as an IP on wg network?
5. If you have any other comments on how things are implemented on low level i would love to hear them!

Thanks 🙏

[moloch--]

1. No, it uses a user space networking stack that only the implant can "see." However, to communicate with it you'll need to create a TUN device.
2. No, but you can use port forwarding/socks5 to tunnel into the target network. We'd like to add the ability to add "routes" in the future though.
3. https://github.com/BishopFox/sliver/wiki/Port-Forwarding has more details on this.
4. Yes, but since it's user space networking only the implant process can "see" the network
5. I'd say the best information can be gleaned from the code itself! At least until we get around to writing better documentation hehe :)

[moloch--]

Also, you'll need to compile from source to fix a regression in WireGuard until we make another release, details at 9118f74