RingReaper - Linux post-exploitation agent that uses io_uring t

项目说明

RingReaper

RingReaper is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to le io_uring, the new asynchronous I/O interface in the Linux kernel, specifically to avoid traditional system calls that most EDRs tend to monitor or even hook.

In practice, RingReaper replaces calls such as read, write, recv, send, connect, among others, with asynchronous I/O operations (io_uring_prep_*), reducing exposure to hooks and event tracing typically collected in a standardized way by security products.

> NOTE: Some functions within RingReaper still rely on traditional calls, such as directory reading (opendir, readdir) or symbolic link resolution (readlink), because io_uring does not yet fully support these types of operations natively. Even so, during my tests, these calls did not trigger alerts on the tested EDRs, precisely because they fall outside the monitored network I/O paths.

In summary, RingReaper was built to avoid traditional calls as much as possible, and even in cases where it had to use them, it demonstrated excellent e capabilities, with no alerts or detections from common security agents.

See the full and detailed article at:

Author:

Rootkit Researchers

Command Reference

| Command | Description | Backend |
|---------------|----------------------------------------------------------|----------------------|
| get | Look files from the target | 100% io_uring |
| put | Upload files (uses recv on the agent side) | 100% io_uring |
| killbpf | Disable tracing, remove /sys/fs/bpf files and kill processes using bpf-map | traditional calls + io_uring |
| users | List logged-in users by reading utmp | 100% io_uring |
| ss / netstat | List TCP connections from /proc/net/tcp | 100% io_uring |
| privesc | Search for SUID binaries using statx | 100% io_uring |
| ps | List processes (uses opendir, readdir) | traditional calls + io_uring |
| kick | Kill pts sessions (uses opendir, readdir, kill, readlink) | traditional calls + io_uring |
| me | Show PID/TTY (getpid, ttyname) | traditional calls + io_uring |
| selfdestruct| Delete the current binary (uses readlink) | traditional calls + io_uring |
| exit | Terminate connection and exit | 100% io_uring |
| help | Display help | 100% io_uring |

In RingReaper, all data traffic, including control commands, uploads, and downloads, must pass through io_uring. This also ensures that the most sensiti remain off the radar of hooks and EDR monitoring based on traditional calls.

About E

RingReaper was designed from the ground up to bypass EDR monitoring. Many security solutions base their detection triggers on intercepting classic syscalls (read, recv, send, connect) at the kernel level. Since io_uring is relatively new and less integrated into the telemetry pipeline of these products, it often goes unnoticed by most agents, allowing for C2 sessions and data exfiltration without triggering alerts.

E that still rely on older syscalls (such as directory reading) remained discreet enough not to raise alarms.

Requirements

Env

Tested ONLY on the following kernel below;

Compilation

Execution

In testing, I noticed that EDR detected the compilation of agent.c by monitoring GCC usage in real time (it's better not to use wget/curl). To bypass this, I compiled the agent statically on my machine, sent the finished binary via temp.sh and used Python on the target to download and execute it. This technique worked without warning.

Server (Attack box) :

Agent (Target machine) :

Upgrades

2.0:
* Support for multiple threaded connections.
* Command history (using the "up" and "down" keys).
* "Clear" command to avoid cluttering the screen.

Contribution

Feel free to make pull requests and contribute to the project.
Any errors with RingReaper, please create an issue and report it to us.

Disclaimer

This code was de solely for educational purposes, research, and controlled demonstrations of e techniques. Any use outside authorized en, or for malicious purposes, is strictly prohibited and entirely the responsibility of the user. Unauthorized or illegal use may local, national, or international laws.

项目信息

开发语言：C

Star 数：387

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。