Local Privilege Escalation via sudo iptables / iptables-save (Comment Newline Injection and --modprobe Abuse)

Key facts for sudo iptables LPE

Detection coverage for sudo iptables LPE

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5127 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: iptables / ip6tables --modprobe Pointing at Non-Standard Program — Exploitation

Detects iptables, ip6tables or the xtables multi-call binary run with --modprobe set to anything other than the system modprobe/kmod. xtables_insmod() execs that path as root when a netfilter module is not loaded, so a user-writable script (for example ./run-me) becomes a root shell under a sudo iptables grant (TL-2026-5127; same class as CVE-2020-28046).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1548.003, T1059.004, T1547.006
• Data sources: sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 (Image="*/iptables-save" OR Image="*/ip6tables-save" OR Image="*/iptables" OR Image="*/ip6tables" OR Image="*/xtables-nft-multi" OR Image="*/xtables-legacy-multi" OR Image="*/xtables-multi") | rex field=CommandLine "--modprobe(?:=|\s+)(?<modprobe_path>\S+)" | where isnotnull(modprobe_path) AND NOT match(modprobe_path,"^/(usr/)?s?bin/(modprobe|kmod)$") | eval user_writable=if(match(modprobe_path,"^([.]{1,2}/|/tmp/|/var/tmp/|/dev/shm/|/home/|/run/user/)") OR NOT match(modprobe_path,"^/"),"yes","no"), tl_threat="TL-2026-5127" | table _time host User ParentImage Image CommandLine modprobe_path user_writable tl_threat | sort 0 - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("iptables-save", "ip6tables-save", "iptables", "ip6tables", "xtables-nft-multi", "xtables-legacy-multi", "xtables-multi")
| where ProcessCommandLine has "--modprobe"
| extend ModprobePath = extract(@"--modprobe(?:=|\s+)(\S+)", 1, ProcessCommandLine)
| where isnotempty(ModprobePath) and ModprobePath !in~ ("/sbin/modprobe", "/usr/sbin/modprobe", "/bin/kmod", "/usr/bin/kmod", "/sbin/kmod", "/usr/sbin/kmod")
| extend UserWritable = ModprobePath matches regex @"^(\.{1,2}/|/tmp/|/var/tmp/|/dev/shm/|/home/|/run/user/)" or ModprobePath !startswith "/"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, ModprobePath, UserWritable

Sigma

title: iptables --modprobe Pointing at Non-Standard Program
id: 6d1f5127-0a02-4c3e-9b11-5127a0000002
status: experimental
description: Detects iptables, ip6tables or xtables multi-call binaries run with --modprobe set to a program other than the system modprobe or kmod, the root command-execution primitive of the sudo iptables LPE (TL-2026-5127, same class as CVE-2020-28046 on ProlinOS).
references:
  - https://www.shielder.com/blog/2024/09/a-journey-from-sudo-iptables-to-local-privilege-escalation/
  - https://gtfobins.github.io/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.privilege-escalation
  - attack.t1548.003
  - attack.execution
  - attack.t1059.004
  - attack.persistence
  - attack.t1547.006
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/iptables-save'
      - '/ip6tables-save'
      - '/iptables'
      - '/ip6tables'
      - '/xtables-nft-multi'
      - '/xtables-legacy-multi'
      - '/xtables-multi'
  selection_cli:
    CommandLine|contains: '--modprobe'
  filter_legit:
    CommandLine|re: '--modprobe(=|\s+)/(usr/)?s?bin/(modprobe|kmod)(\s|$)'
  condition: selection_img and selection_cli and not filter_legit
falsepositives:
  - Embedded images or containers that ship a wrapper script as the modprobe replacement
level: high

Known false positives:

• Embedded or appliance firmware that deliberately points --modprobe at a vendor wrapper script
• Container build tooling that runs iptables with a custom modprobe path

Tuning notes: Add your vendor wrapper paths to the exclusion regex. Escalate immediately when user_writable=yes. Pre-loading netfilter modules at boot (/etc/modules-load.d) neutralises the primitive but the attempt is still worth alerting on.

• 🔒 iptables Rule Comment Carrying Embedded Newline or Forged passwd Entry — Exploitation · unlock with TL Creds
• 🔒 iptables Binary Writes to Sensitive Root-Owned File — Post-Exploitation · unlock with TL Creds
• 🔒 su Within 30 Minutes of iptables-save Overwriting [indicator] — Forged Root Account Use · unlock with TL Creds
• 🔒 openssl passwd Hash Generation by Non-Root User — Forged Account Preparation · unlock with TL Creds
• 🔒 iptables Family Binary Spawning Shell or Unexpected Child Process — Post-Exploitation Root Shell · unlock with TL Creds
• 🔒 Pre-Exploitation Reconnaissance: sudo -l, Loaded-Module Checks and sudoers iptables Grep — Discovery · unlock with TL Creds
• 🔒 sudo iptables-save -f Overwrite of Sensitive Root-Owned File ([indicator]) — Exploitation · unlock with TL Creds
• 🔒 sudo Log: iptables Family Run as Root with --modprobe, -f/--file or --comment — Exploitation (sudo audit trail) · unlock with TL Creds

Indicators of compromise for sudo iptables LPE

As of 2026-11-03, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5127.

How sudo iptables LPE works

On 20 September 2024, Shielder published 'A Journey From sudo iptables To Local Privilege Escalation,' documenting two independent local privilege escalation (LPE) primitives that arise whenever a sudoers policy grants an unprivileged user NOPASSWD (or password-authenticated) execution of the iptables/iptables-save/ip6tables utilities — a common pattern on systems where junior admins or automation accounts are given narrow 'just enough' firewall-management rights.

Primitive 1 — --modprobe command execution: iptables (and ip6tables) accept a --modprobe=<path> flag that overrides the program used to load a missing netfilter kernel module. Internally, the iptables/xtables-legacy and nf_tables codebases call xtables_insmod(), which execv()s the attacker-supplied path whenever the kernel module required by the invoked match/target is not already resident. An attacker who controls the --modprobe argument (e.g. sudo iptables -L -t nat --modprobe=./run-me) supplies a small script (#!/bin/bash; /bin/bash -i) and iptables executes it as root. The researchers reused this same primitive to explain the 2020 PAX ProlinOS payment-terminal root escalation (CVE-2020-28046), where a setuid xtables-multi binary and ip6tables --modprobe were abused identically. The practical limitation is that on modern distributions the relevant kernel modules (ip_tables, nf_tables, iptable_nat, etc.) are usually already loaded at boot, which prevents xtables_insmod() from firing; the technique is most reliable against uncommon match/target modules or minimal/embedded images where modules are not pre-loaded.

Primitive 2 — comment newline injection + iptables-save -f file overwrite: iptables' -m comment --comment match stores an arbitrary string per rule, and critically preserves literal newline characters placed inside it via bash ANSI-C quoting ($'...'). When iptables-save serializes the ruleset, each comment is emitted verbatim inside the dump, so a comment containing \n effectively injects new, attacker-chosen lines into the output file. Because iptables-save supports a -f <path> flag to write the dump directly to a file, and because sudo grants this write as root, an attacker who also has sudo rights to iptables-save can: (1) add a rule whose comment is a forged /etc/passwd line such as root2:$1$hash$...:0:0:root:/root:/bin/bash (hash generated locally via openssl passwd), crafted to parse as a valid passwd entry with UID/GID 0; (2) run sudo iptables-save -f /etc/passwd to atomically overwrite the system password file as root, appending/corrupting it with the forged, password-known root-equivalent account; (3) su into the new account using the attacker-chosen password to obtain a root shell. The technique generalizes to any root-owned, newline-delimited configuration file that tolerates malformed/unknown lines gracefully (the researchers specifically call out this file-format requirement), making /etc/passwd the cleanest demonstrated target but not the only theoretical one. Shielder further notes that iptables supports argv[0]-based binary aliasing (the iptables binary can behave as iptables-save depending on how it is invoked), which could let an attacker reach the save/overwrite primitive from a sudoers rule that only explicitly names /usr/sbin/iptables, reducing the practical prerequisite from 'two sudo rules' toward 'one sudo rule, loosely specified.'

Both primitives were validated by Shielder on Ubuntu 24.04 LTS running iptables v1.8.10 with the nf_tables backend, under a lab sudoers configuration granting NOPASSWD: /usr/bin/iptables and NOPASSWD: /usr/bin/iptables-save. No CVE has been assigned to either primitive — the researchers frame it as a known-class 'sudo misconfiguration leads to full compromise' issue cataloged conceptually by GTFOBins (which lists iptables/iptables-save as privilege-escalation-capable binaries when run via sudo), and traces the comment/file-write idea back to a 2017 TurinCTF challenge the authors themselves had designed. Exploitation requires only an interactive local shell and the described sudoers grant; there is no remote or network vector, no malware payload, and no C2 infrastructure — this is a pure misconfiguration-abuse LPE technique, not an in-the-wild campaign. Defenders should treat this as a sudoers-hygiene and detection-engineering problem: audit sudoers/sudoers.d for iptables, iptables-save, ip6tables, ip6tables-save, xtables-multi and iptables-restore entries, avoid blanket NOPASSWD grants, and monitor process execution of these binaries for the --modprobe flag or the iptables-save -f flag targeting sensitive paths (/etc/passwd, /etc/shadow, /etc/sudoers, /etc/cron*, /etc/ssh/*), as well as iptables rule additions whose comment field contains embedded newline/control characters.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Defense Evasion

T1078.003 Valid Accounts: Local Accounts

Discovery

T1082 System Information Discovery

Persistence

T1136.001 Create Account: Local Account; T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions

Privilege Escalation

T1548 Abuse Elevation Control Mechanism; T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

defense-impairment

T1686 Disable or Modify System Firewall

Remediation for sudo iptables LPE

Patches

• No vendor patch exists; this is a sudoers-configuration misuse class rather than a software defect. No CVE has been assigned.

Immediate actions

• Audit /etc/sudoers and /etc/sudoers.d/* for any rule granting iptables, iptables-save, ip6tables, ip6tables-save, iptables-restore, ip6tables-restore, or xtables-multi to non-administrative accounts.
• Remove NOPASSWD from any such sudoers entries and require password re-authentication for firewall-management commands.
• Where firewall-management delegation is required, wrap it in a restrictive script/API instead of raw sudo access to the iptables binaries so that --modprobe and -f cannot be supplied.

Workarounds

• Pre-load all netfilter kernel modules used in the environment at boot (via /etc/modules-load.d or equivalent) so iptables never needs to invoke modprobe, neutralizing the --modprobe primitive.
• Grant sudo access to only one of iptables or iptables-save (never both) for a given account, and disable argv[0] binary aliasing where supported, to break the comment-injection chain.

Longer-term hardening

• Replace broad iptables sudoers delegation with a least-privilege firewall-management tool or role-based API that does not expose raw binary flags to delegated operators.
• Deploy file integrity monitoring on root-owned sensitive files (/etc/passwd, /etc/shadow, /etc/sudoers, /etc/cron*, /etc/ssh/sshd_config) to detect unexpected root-level overwrites.
• Deploy EDR/auditd rules that alert on iptables-save invocations using the -f flag targeting files outside standard firewall-rules paths, and on any iptables/ip6tables invocation using --modprobe.
• Enforce AppArmor/SELinux confinement on iptables/iptables-save to restrict writable file paths even when invoked as root via sudo.

Affected and fixed versions

• Netfilter Project — iptables
  Vulnerable versions: 1.8.10 and prior versions sharing the same --modprobe and comment-handling behavior
• Canonical — Ubuntu Server / Desktop
  Vulnerable versions: 24.04 LTS (tested configuration)
• PAX Technology — ProlinOS (payment terminal OS, historical related primitive)
  Vulnerable versions: ProlinOS through 2.4.161.8859R
  Fixed in: Vendor patch addressing CVE-2020-28046

Timeline of sudo iptables LPE

• 2017-01-01 TurinCTF 2017 finals include a challenge designed by the locked-ioc-6 researchers (then independent) that first encodes the sudo-iptables-to-passwd-overwrite idea as a CTF puzzle, later cited as the conceptual origin of the comment-injection primitive.
• 2020-01-01 CVE-2020-28046 is disclosed: PAX ProlinOS payment terminals are found vulnerable to root privilege escalation via a setuid xtables-multi binary combined with ip6tables --modprobe, the same primitive later generalized in the 2024 locked-ioc-6 research.
• 2023-03-01 Yarix Labs publishes 'PrivEsc on a production-mode POS,' further analyzing modprobe-based privilege escalation on PAX payment devices.
• 2024-09-20 locked-ioc-6 explicitly notes no CVE is requested or assigned, classifying the issue as a known misconfiguration class rather than a discrete software vulnerability.
• 2024-09-20 locked-ioc-6 publishes full PoC command sequences for both primitives (--modprobe=./run-me payload execution; locked-ioc-5 -m comment with embedded newline forging a root locked-ioc-4 entry followed by locked-ioc-2 -f locked-ioc-4) alongside recommended mitigations.
• 2024-09-20 locked-ioc-6 (suidpit and smaury) publishes 'A Journey From sudo locked-ioc-5 To Local Privilege Escalation,' documenting both the --modprobe command-execution primitive and the locked-ioc-2 comment-newline-injection file-overwrite primitive, with a working Ubuntu 24.04 LTS / locked-ioc-5 1.8.10 proof of concept targeting locked-ioc-4.
• 2026-11-03 Threadlinqs threat-hunting pipeline selects the locked-ioc-6 research as a public-PoC, misconfiguration-based LPE technique for detection-engineering coverage (sudoers auditing, sudo locked-ioc-5/locked-ioc-2 process monitoring).

Sources cited for sudo iptables LPE

• NVD - CVE-2020-28046 Detail NVD (NIST) · Advisory · 2021-02-02
• A Journey From sudo iptables To Local Privilege Escalation (Shielder, by suidpit and smaury) shielder.com · Research · 2024-09-20
• PrivEsc on a production-mode POS (Yarix Labs, related ip6tables --modprobe analysis on PAX devices) labs.yarix.com · Research · 2023-03-01
• iptables libxtables xtables.c (modprobe/xtables_insmod implementation) GitHub · Code repository
• pax-pwn: Vulnerabilities and tools for PAX Payment Devices (CVE-2020-28046 privilege escalation) git.lsd.cat · Code repository
• TurinCTF 2017 Finals writeup (original iptables sudo privesc CTF design) jbz.team · Blog
• Shielder - suidpit author profile (researcher attribution) shielder.com · Blog
• GTFOBins gtfobins.github.io · Reference

More in vulnerability

• Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets (LND macaroon credential exposure)
• CVE-2026-31695: 5-Year-Old Linux Kernel virt_wifi Use-After-Free Allows Unprivileged Local Root
• Attackers Target Unpatched CryptoPayment Gateway WordPress Plugin Flaw (CVE-2026-81648) Exposing Wallet Credentials
• FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)
• PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)

Related coverage of this activity

• sudo iptables privilege escalation