iptables-save

Save the iptables IPv4 configuration. Use ip6tables-save to do the same for IPv6. tldr-pages

GTFOBins file-write 1 documented command

How iptables-save is abused

documented by GTFOBins

file-write

-f

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for iptables-save.

1 documented command

from GTFOBins, each read by the identifier

file-write with sudo

The content is written along with a number of iptables rules.

iptables -A INPUT -i lo -j ACCEPT -m comment --comment DATA
iptables -S
iptables-save -f /path/to/output-file

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for iptables-save. The identifier reads the line that runs iptables-save.

Everyday use

from tldr-pages, CC BY 4.0

Print the iptables configuration

sudo iptables-saveIdentify

Print the iptables configuration of a specific table

sudo iptables-save --table tableIdentify

Save the iptables configuration to a file

sudo iptables-save --file path/to/fileIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

iptables-save

How iptables-save is abused

1 documented command

Everyday use

Other programs abused for file-write