# Local Privilege Escalation via sudo iptables / iptables-save (Comment Newline Injection and --modprobe Abuse)

> Shielder researchers (suidpit, smaury) demonstrated that a low-privileged Linux user granted sudo rights over iptables and iptables-save can escalate to root: iptables preserves embedded newlines in rule comments, letting an attacker craft a forged /etc/passwd entry that iptables-save (run as root via sudo) writes out when invoked with -f, and iptables' --modprobe flag can separately be abused to execute an arbitrary attacker-controlled command when a required kernel module is not already loaded.

- **Published:** 2026-11-03T06:40:19Z
- **Last reviewed:** 2026-11-03T06:40:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5127
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5127.png
- **ID:** TL-2026-5127
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 6
- **CVEs:** CVE-2020-28046

## Description

On 20 September 2024, Shielder published 'A Journey From sudo iptables To Local Privilege Escalation,' documenting two independent local privilege escalation (LPE) primitives that arise whenever a sudoers policy grants an unprivileged user NOPASSWD (or password-authenticated) execution of the iptables/iptables-save/ip6tables utilities — a common pattern on systems where junior admins or automation accounts are given narrow 'just enough' firewall-management rights.

Primitive 1 — --modprobe command execution: iptables (and ip6tables) accept a --modprobe=<path> flag that overrides the program used to load a missing netfilter kernel module. Internally, the iptables/xtables-legacy and nf_tables codebases call xtables_insmod(), which execv()s the attacker-supplied path whenever the kernel module required by the invoked match/target is not already resident. An attacker who controls the --modprobe argument (e.g. sudo iptables -L -t nat --modprobe=./run-me) supplies a small script (#!/bin/bash; /bin/bash -i) and iptables executes it as root. The researchers reused this same primitive to explain the 2020 PAX ProlinOS payment-terminal root escalation (CVE-2020-28046), where a setuid xtables-multi binary and ip6tables --modprobe were abused identically. The practical limitation is that on modern distributions the relevant kernel modules (ip_tables, nf_tables, iptable_nat, etc.) are usually already loaded at boot, which prevents xtables_insmod() from firing; the technique is most reliable against uncommon match/target modules or minimal/embedded images where modules are not pre-loaded.

Primitive 2 — comment newline injection + iptables-save -f file overwrite: iptables' -m comment --comment match stores an arbitrary string per rule, and critically preserves literal newline characters placed inside it via bash ANSI-C quoting ($'...'). When iptables-save serializes the ruleset, each comment is emitted verbatim inside the dump, so a comment containing \n effectively injects new, attacker-chosen lines into the output file. Because iptables-save supports a -f <path> flag to write the dump directly to a file, and because sudo grants this write as root, an attacker who also has sudo rights to iptables-save can: (1) add a rule whose comment is a forged /etc/passwd line such as root2:$1$hash$...:0:0:root:/root:/bin/bash (hash generated locally via openssl passwd), crafted to parse as a valid passwd entry with UID/GID 0; (2) run sudo iptables-save -f /etc/passwd to atomically overwrite the system password file as root, appending/corrupting it with the forged, password-known root-equivalent account; (3) su into the new account using the attacker-chosen password to obtain a root shell. The technique generalizes to any root-owned, newline-delimited configuration file that tolerates malformed/unknown lines gracefully (the researchers specifically call out this file-format requirement), making /etc/passwd the cleanest demonstrated target but not the only theoretical one. Shielder further notes that iptables supports argv[0]-based binary aliasing (the iptables binary can behave as iptables-save depending on how it is invoked), which could let an attacker reach the save/overwrite primitive from a sudoers rule that only explicitly names /usr/sbin/iptables, reducing the practical prerequisite from 'two sudo rules' toward 'one sudo rule, loosely specified.'

Both primitives were validated by Shielder on Ubuntu 24.04 LTS running iptables v1.8.10 with the nf_tables backend, under a lab sudoers configuration granting NOPASSWD: /usr/bin/iptables and NOPASSWD: /usr/bin/iptables-save. No CVE has been assigned to either primitive — the researchers frame it as a known-class 'sudo misconfiguration leads to full compromise' issue cataloged conceptually by GTFOBins (which lists iptables/iptables-save as privilege-escalation-capable binaries when run via sudo), and traces the comment/file-write idea back to a 2017 TurinCTF challenge the authors themselves had designed. Exploitation requires only an interactive local shell and the described sudoers grant; there is no remote or network vector, no malware payload, and no C2 infrastructure — this is a pure misconfiguration-abuse LPE technique, not an in-the-wild campaign. Defenders should treat this as a sudoers-hygiene and detection-engineering problem: audit sudoers/sudoers.d for iptables, iptables-save, ip6tables, ip6tables-save, xtables-multi and iptables-restore entries, avoid blanket NOPASSWD grants, and monitor process execution of these binaries for the --modprobe flag or the iptables-save -f flag targeting sensitive paths (/etc/passwd, /etc/shadow, /etc/sudoers, /etc/cron*, /etc/ssh/*), as well as iptables rule additions whose comment field contains embedded newline/control characters.

## MITRE ATT&CK

- T1548 Abuse Elevation Control Mechanism
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1136.001 Create Account: Local Account
- T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions
- T1078.003 Valid Accounts: Local Accounts
- T1686 Disable or Modify System Firewall
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1082 System Information Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**iptables / ip6tables --modprobe Pointing at Non-Standard Program — Exploitation** (`TL-2026-5127-SPL-002`)

Detects iptables, ip6tables or the xtables multi-call binary run with --modprobe set to anything other than the system modprobe/kmod. xtables_insmod() execs that path as root when a netfilter module is not loaded, so a user-writable script (for example ./run-me) becomes a root shell under a sudo iptables grant (TL-2026-5127; same class as CVE-2020-28046).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1548.003, T1059.004, T1547.006
- **Data sources:** sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 (Image="*/iptables-save" OR Image="*/ip6tables-save" OR Image="*/iptables" OR Image="*/ip6tables" OR Image="*/xtables-nft-multi" OR Image="*/xtables-legacy-multi" OR Image="*/xtables-multi") | rex field=CommandLine "--modprobe(?:=|\s+)(?<modprobe_path>\S+)" | where isnotnull(modprobe_path) AND NOT match(modprobe_path,"^/(usr/)?s?bin/(modprobe|kmod)$") | eval user_writable=if(match(modprobe_path,"^([.]{1,2}/|/tmp/|/var/tmp/|/dev/shm/|/home/|/run/user/)") OR NOT match(modprobe_path,"^/"),"yes","no"), tl_threat="TL-2026-5127" | table _time host User ParentImage Image CommandLine modprobe_path user_writable tl_threat | sort 0 - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("iptables-save", "ip6tables-save", "iptables", "ip6tables", "xtables-nft-multi", "xtables-legacy-multi", "xtables-multi")
| where ProcessCommandLine has "--modprobe"
| extend ModprobePath = extract(@"--modprobe(?:=|\s+)(\S+)", 1, ProcessCommandLine)
| where isnotempty(ModprobePath) and ModprobePath !in~ ("/sbin/modprobe", "/usr/sbin/modprobe", "/bin/kmod", "/usr/bin/kmod", "/sbin/kmod", "/usr/sbin/kmod")
| extend UserWritable = ModprobePath matches regex @"^(\.{1,2}/|/tmp/|/var/tmp/|/dev/shm/|/home/|/run/user/)" or ModprobePath !startswith "/"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, ModprobePath, UserWritable
```

### Sigma

```yaml
title: iptables --modprobe Pointing at Non-Standard Program
id: 6d1f5127-0a02-4c3e-9b11-5127a0000002
status: experimental
description: Detects iptables, ip6tables or xtables multi-call binaries run with --modprobe set to a program other than the system modprobe or kmod, the root command-execution primitive of the sudo iptables LPE (TL-2026-5127, same class as CVE-2020-28046 on ProlinOS).
references:
  - https://www.shielder.com/blog/2024/09/a-journey-from-sudo-iptables-to-local-privilege-escalation/
  - https://gtfobins.github.io/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.privilege-escalation
  - attack.t1548.003
  - attack.execution
  - attack.t1059.004
  - attack.persistence
  - attack.t1547.006
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/iptables-save'
      - '/ip6tables-save'
      - '/iptables'
      - '/ip6tables'
      - '/xtables-nft-multi'
      - '/xtables-legacy-multi'
      - '/xtables-multi'
  selection_cli:
    CommandLine|contains: '--modprobe'
  filter_legit:
    CommandLine|re: '--modprobe(=|\s+)/(usr/)?s?bin/(modprobe|kmod)(\s|$)'
  condition: selection_img and selection_cli and not filter_legit
falsepositives:
  - Embedded images or containers that ship a wrapper script as the modprobe replacement
level: high

```

**Known false positives:**

- Embedded or appliance firmware that deliberately points --modprobe at a vendor wrapper script
- Container build tooling that runs iptables with a custom modprobe path

**Tuning notes:** Add your vendor wrapper paths to the exclusion regex. Escalate immediately when user_writable=yes. Pre-loading netfilter modules at boot (/etc/modules-load.d) neutralises the primitive but the attempt is still worth alerting on.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- iptables Rule Comment Carrying Embedded Newline or Forged passwd Entry — Exploitation (locked: unlock with TL Creds)
- iptables Binary Writes to Sensitive Root-Owned File — Post-Exploitation (locked: unlock with TL Creds)
- su Within 30 Minutes of iptables-save Overwriting [indicator] — Forged Root Account Use (locked: unlock with TL Creds)
- openssl passwd Hash Generation by Non-Root User — Forged Account Preparation (locked: unlock with TL Creds)
- iptables Family Binary Spawning Shell or Unexpected Child Process — Post-Exploitation Root Shell (locked: unlock with TL Creds)
- Pre-Exploitation Reconnaissance: sudo -l, Loaded-Module Checks and sudoers iptables Grep — Discovery (locked: unlock with TL Creds)
- sudo iptables-save -f Overwrite of Sensitive Root-Owned File ([indicator]) — Exploitation (locked: unlock with TL Creds)
- sudo Log: iptables Family Run as Root with --modprobe, -f/--file or --comment — Exploitation (sudo audit trail) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [A Journey From sudo iptables To Local Privilege Escalation (Shielder, by suidpit and smaury)](https://www.shielder.com/blog/2024/09/a-journey-from-sudo-iptables-to-local-privilege-escalation/)
- [GTFOBins](https://gtfobins.github.io/)
- [iptables libxtables xtables.c (modprobe/xtables_insmod implementation)](https://github.com/cernekee/iptables/blob/upstream/libxtables/xtables.c#L403)
- [TurinCTF 2017 Finals writeup (original iptables sudo privesc CTF design)](https://jbz.team/turinctf2017/turinctf_finals#6)
- [pax-pwn: Vulnerabilities and tools for PAX Payment Devices (CVE-2020-28046 privilege escalation)](https://git.lsd.cat/g/pax-pwn/src/master/Readme.md#privilege-escalation-cve-2020-28046)
- [NVD - CVE-2020-28046 Detail](https://nvd.nist.gov/vuln/detail/CVE-2020-28046)
- [PrivEsc on a production-mode POS (Yarix Labs, related ip6tables --modprobe analysis on PAX devices)](https://labs.yarix.com/2023/03/privesc-on-a-production-mode-pos/)
- [Shielder - suidpit author profile (researcher attribution)](https://www.shielder.com/authors/suidpit)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5127