Furtex - Post-exploitation and evasion research toolkit for

项目说明

Furtex

Post-exploitation and e research toolkit for Linux, built around io_uring and eBPF. No liburing, no frameworks, raw syscalls throughout.

More tools soon. PRs are welcome. 🇧🇷

Join in Rootkit Researchers

For authorized research and red team engagements only. Don't run this on systems you don't own.

<img src=" width="720"/>

Requirements

Toolchain

| tool | needed for |
|---|---|
| gcc | all userspace binaries |
| clang | ebpf/*.bpf.c BPF-side programs |
| make | build system |

Headers and libraries

| package | needed for |
|---|---|
| linux-headers-$(uname -r) | <linux/bpf.h>, <linux/io_uring.h> and related kernel headers |
| libbpf-dev | <bpf/bpf_helpers.h> and friends used in ebpf/ programs |
| bpftool | generate .h via make inside ebpf/ |

On Debian/Kali/Ubuntu:

Kernel

| minimum | what it unlocks |
|---|---|
| 5.4 | io_uring base (IORING_FEAT_SINGLE_MMAP, BPF map iteration) |
| 5.6 | IORING_OP_OPENAT, IORING_OP_STATX, pidfd_getfd (pidfd_steal) |
| 5.8 | CAP_BPF + CAP_PERFMON split (replaces CAP_SYS_ADMIN for BPF) |
| 5.9 | BPF_LINK_DETACH (bpf_link_detach) |
| 5.19 | IORING_OP_SOCKET (af_packet_send, dns_exfil, xdp_socket_send, bpf_kprobe_bypass) |

Capabilities

| capability | tools that require it |
|---|---|
| CAP_BPF (or CAP_SYS_ADMIN pre-5.8) | all bpf/ tools, ebpf/ loaders |
| CAP_PERFMON | ebpf/ tracepoint and kprobe programs |
| CAP_NET_RAW | icmp_tunnel, af_packet_shell, skf_c2_runner, icmp_trigger |
| CAP_NET_ADMIN | xdp_socket_send, netfilter_flush |
| CAP_AUDIT_CONTROL | audit_kill |

BTF must be enabled in the kernel (CONFIG_DEBUG_INFO_BTF=y) to run make for ebpf/ programs.

On distros with older libc-de (Ubuntu 22.04 etc.) you may need #ifndef IORING_OP_SOCKET / #define IORING_OP_SOCKET 45. Already handled in this repo.

Build

| command | builds |
|---|---|
| make all | e |
| make uring | io_uring/ only |
| make bpf | bpf/ userspace tools |
| make ebpf | BPF-side programs (needs clang + libbpf) |
| make edrs | all edrs/ binaries |
| make techniques | Falco bypass tools |
| make clean | remove all binaries |

edrs/ has its own sub-Makefile with ~75 binaries split by pri:

See PRI.md for the full breakdown.

io_uring bypass co

io_uring SQEs go through the kernel workqueue. io_uring_enter(2) ne through sys_call_table, ne sys_enter_* tracepoints, and never hits li on nati. That alone kills a large class of EDR hooks without touching anything.

What io_uring bypasses on its own:

| hook point | note |
|---|---|
| sys_call_table pointer replacement | io_uring never goes through the syscall table |
| li on nati / compat_sys_call | same reason |
| sys_enter_* tracepoints | workqueue path, no tracepoint fires |

What io_uring does NOT bypass on its own (needs an active tool):

| hook point | tool | what the tool does |
|---|---|---|
| kprobes on , security_file_open, etc. | ftrace_enum | removes the kprobe hooks |
| BPF LSM / KRSI | bpf_link_detach | detaches the BPF link |
| Linux audit | audit_kill | disables auditd |
| LD_PRELOAD / PLT-GOT patches | plt_unhook | removes the userland hooks |
| netfilter OUTPUT / conntrack | af_packet_shell | uses AF_PACKET at layer 2, skips netfilter |
| inet_stream_connect hooks | udp_shell | uses UDP, ne tcp connect path |

io_uring/

iouring_utils.h handles ring setup without liburing.

| binary | what it does |
|---|---|
| file_read | OPENAT+READ+CLOSE chain , no sys_enter_read event |
| file_write | OPENAT+WRITE+CLOSE chain |
| file_append | same as file_write but O_APPEND, offset -1 |
| net_connect | SOCKET+CONNECT+SEND+RECV in one ring |
| net_re | reverse shell o CONNECT |
| multifile_read | up to 64 files in one SQE batch |
| memfd_exec | stream ELF into memfd, execve via /proc/self/fd |
| proc_inject | JIT injection via /proc/PID/mem; ptrace injection (--ptrace flag) |
| pipe_splice | SPLICE kernel-to-kernel, userspace hooks never see bytes |
| inotify_bypass_watch | io_uring READ does not raise IN_ACCESS/IN_OPEN |
| dns_exfil | hex-encode data as DNS query labels o SENDMSG |
| af_packet_send | raw Ethernet (IORING_OP_SOCKET, bypasses inet path) |
| xdp_socket_send | raw frame + UMEM ring, bypasses netfilter entirely |

bpf/

Most tools require CAP_BPF. en works unpri. icmp_trigger requires CAP_NET_RAW instead of CAP_BPF.

| binary | what it does |
|---|---|
| map_recon | list all loaded BPF maps |
| map_dumper | dump map contents by ID |
| map_write | update map entries by ID |
| map_poison | zero Falco's interesting_sys entries around a payload |
| prog_recon | list BPF programs: type, name, map count |
| pid_allowlist | insert PID into an EDR allowlist map |
| edr_fin | score loaded BPF maps/programs against known EDR heuristics |
| lsm_check | detect active BPF LSM hooks and test if map writes are blocked |
| bpf_persist | pin/retrie maps and programs on bpffs |
| map_snapshot | save and restore map contents to a binary file |
| en | read /proc/*/environ for secrets |
| bpf_link_detach | enumerate and detach BPF links (removes LSM hooks) |
| link_update | redirect a BPF link to a no-op program (hook stays , fires nothing) |
| map_freeze | freeze a BPF map read-only via BPF_MAP_FREEZE (writes return -EPERM) |
| icmp_trigger | ICMP magic-packet backdoor; spawns reverse shell relay; masquerades as kworker/u4:2 |

ebpf/

Requires clang + libbpf + .h. Run make inside ebpf/ to generate from the running kernel's BTF.

| file | what it does |
|---|---|
| exec.bpf.c | tracepoint on sys_enter_execve |
| fentry_open.bpf.c | tracepoint on sys_enter_openat |
| creds.bpf.c | track openat+read on credential paths |
| keylog.bpf.c | input event tracepoint, raw keycode capture |
| net.bpf.c | sys_enter_connect logging |
| net_hide.bpf.c | hide ports from /proc/net/tcp and /proc/net/udp |
| proc_hide.bpf.c | hide PIDs from getdents64 output |
| tty_sniff.bpf.c | capture stdin/stdout/stderr writes and reads |
| skf_c2_runner.c | ICMP C2 BPF socket filter |
| xdp_backdoor.bpf.c + xdp_handler.c | XDP trigger on magic UDP packet |

edrs/

| binary | root | technique |
|---|:---:|---|
| edr_recon | yes | 12- EDR detector: processes, artifacts, modules, BPF, kprobes |
| bpf_prog_recon | yes | enumerate loaded BPF programs, maps, and kprobes |
| bpf_map_wipe | yes | wipe BPF map entries |
| bpf_detach_all | yes | detach all BPF links |
| tetragon_blind | yes | scan, freeze, thaw, kill or blind Tetragon/Falco processes |
| ftrace_enum | yes | enumerate and clear kprobe/ftrace hooks |
| lkm_unload | yes | unload kernel modules |
| lkm_inline_detect | yes | detect inline kernel hooks |
| perf_bpf_kill | yes | enumerate and kill Falco perf-event BPF programs |
| module_recon | yes | enumerate kernel modules |
| cgroup_freeze | yes | freeze/thaw process v2 |
| oom_cage | yes | set oom_score_adj for self or target |
| sysctl_blind | yes | read/write security-relevant sysctls |
| audit_kill | yes | disable/throttle Linux audit |
| inotify_exhaust | yes | consume all inotify watches |
| netfilter_flush | yes | flush netfilter chains |
| dmesg_wipe | yes | clear kernel ring buffer |
| ld_so_preload | yes | manipulate /etc/ld.so.preload |
| proc_hide | yes | hide /proc/PID |
| mount_over | yes | bind-mount o paths |
| log_wipe | yes | truncate log files and shell history |
| elf_infect | yes | PT_NOTE to PT_LOAD parasite injection |
| proc_mem_inject | yes | pwrite to /proc/PID/mem, no ptrace attach |
| af_packet_shell | yes | raw Ethernet C2 bypassing netfilter OUTPUT |
| icmp_tunnel | yes | exfil via ICMP echo-request payload |
| e | yes | event flood around payload to saturate monitor |
| li | yes | io_uring past li hooks on syscall dispatcher |
| li | yes | disable li + BPF kprobe + netfilter hook stack; module unload via comm spoofing |
| lsm_authlink_blind | yes | disable LSM auth-link flows, freeze or kill auth agent, write swap |
| lsm_callback_bypass | yes | bypass LSM callbacks , process_, perf+BPF attach, new netns |
| bpf_fim_blind | yes | freeze BPF FIM sensor, wipe ring-buffer map entries, flood ringbuf |
| syscall_dispatch_bypass | yes | io_uring file/net ops bypassing kprobes on syscall dispatch and li do_syscall_64 |
| bpf_kprobe_bypass | yes | io_uring file/net/exec ops bypassing __x64_sys_* kprobe targets |
| ptrace_inject_so | yes | load .so into li + dlopen |
| uring_stealth | no | file/net ops , no sys_enter_* events |
| openat2_bypass | no | alternati (openat2, copy_file_range) |
| ptrace_selfguard | no | block external ptrace process |
| plt_unhook | no | detect and bypass PLT-GOT hooks |
| fexec | no | ELF into memfd, execve via /proc/self/fd |
| memfd_loader | no | load .so , constructor called |
| memfd_userexec | no | ELF from stdin into memfd, execve via /proc/self/fd |
| hollow_proc | no | process hollowing with decoy name in ps |
| arg | no | rename comm (PR_SET_NAME) and argv[0] o |
| clone_netns | no | unpri net namespace exec |
| ns_exec | no | unshare user/pid/mount namespaces |
| splice_c2 | no | TCP C2 using splice(2) for data transfer; send/rec never fire |
| abstract_sock_c2 | no | C2 o Unix socket |
| udp_shell | no | UDP reverse shell, bypasses inet_stream_connect |
| tls_shell | no | reverse shell behind fake TLS ClientHello |
| dns_exfil_raw | no | hex-encode data as DNS query labels |
| pidfd_steal | no | steal open fds from other processes |
| | no | RWX to PROT_NONE cycle, MAD, |
| coredump_block | no | block core dumps /dumpable/rlimit |
| seccomp_notify | no | intercept syscalls |
| ipc_covert | no | C2 o mqueue |
| shared_mem_c2 | no | C2 o shm, no network traffic |
| pipe_exfil | no | splice(2) exfil, LD_PRELOAD hooks blind |
| proc_fd_scan | no | scan /proc/PID/fd symlinks for sensiti |
| proc_ | no | process_, no /proc/PID/fd opened |
| self_delete | no | delete own binary from disk while running |
| time_stomp | no | clone/zero/set atime+mtime |
| userland_persist | no | bashrc/crontab/autostart/authorized_keys |
| en | no | read /proc/*/environ for secrets and SSH sockets |
| anon_shellcode | no | shellcode in MAP_ANONYMOUS, no file, no execve |
| ld_preload_inject | no | drop .so, inject |
| ssh_agent_hijack | no | speak agent protocol to captured socket |
| fanotify_bypass | no | memfd/anon-mmap/devshm to avoid fanotify marks |
| ringbuf_flood | no | saturate BPF ringbuf to drop events |
| log_e | no | io_uring file ops and raw-syscall TCP shell, no libc wrappers |
| syscalltable_bypass | no | io_uring past sys_call_table pointer hooks |
| uring_recon_unpriv | no | credentials, keys, connections read |
| fd_steal_read | no | steal fds , read without own open() |
| mmap_read | no | read files via mmap, no read() syscall |
| scm_rights_exfil | no | pass fd o, read without own open() |
| splice_read | no | read (2), no userspace buffer |

techniques/ (Falco bypass)

Targets Falco's default ruleset (modern_ebpf driver, 25 rules). Run edrs/edr_recon first.

Bypass axis A: prevent the event from reaching Falco (io_uring skips sys_enter_*, ringbuf drain silently drops events).
Bypass axis B: event reaches Falco but the rule condition doesn't match (proc.name spoof, path pivot, alternate flags).

| tool | axis | Falco rules |
|---|:---:|---|
| uring_ops | A | 1 2 3 7 9 10 12 13 14 15 18 21 |
| ringbuf_o | A | all |
| rule_evade | B | 3 5 6 17 |
| kmod_unload | A | all |
| proc_ghost | A/B | 22 23 25 |
| exe_from_memfd_bypass | B | 25 |
| e | A | all |
| proc_masquerade | B | 3 4 5 8 17 |
| ns_pivot | B | 6 14 |
| cgroup_escape | A | 18 |
| bypass_file_rules | B | 1 2 3 9 10 11 12 13 21 |
| bypass_proc_rules | B | 4 6 8 15 17 18 19 20 22 23 24 |
| per_rule_bypass | A/B | all 25 |

| Rule | Bypass | Tool |
|---|---|---|
| 1 Directory tra monitored file read | io_uring OPENAT | uring_ops cat, per_rule_bypass dir-tra |
| 3 Read sensitive file untrusted | io_uring or prctl | uring_ops creds, bypass_file_rules read-masked |
| 4 Run shell untrusted | python3/perl instead of sh | rule_evade unusual-shell |
| 6 Terminal shell in container | setsid, proc.tty=0 | bypass_proc_rules shell-notty |
| 7 Contact K8S API Server | io_uring CONNECT | uring_ops shell, per_rule_bypass k8s-connect |
| 8 Netcat RCE | C binary, proc.name != nc/ncat | bypass_proc_rules re |
| 9 Search Private Keys | open+read in C, no grep/find | bypass_file_rules grep-bypass |
| 10 Clear Log Acti | ftruncate without O_TRUNC | bypass_file_rules log-clear |
| 11 Remove Bulk Data | write loop, no shred/mkfs | bypass_file_rules wipe |
| 15 Redirect STDOUT/STDIN to Network | fcntl F_DUPFD instead of dup2 | bypass_proc_rules re |
| 18 Detect release_agent Escape | io_uring OPENAT+WRITE to release_agent | cgroup_escape proof/shell, uring_ops write |
| 19 PTRACE attached to process | /proc/PID/mem or process_ | bypass_proc_rules proc-inject |
| 20 PTRACE anti-debug attempt | TracerPid check via /proc/self/status | bypass_proc_rules anti-debug |
| 22 Execution from /dev/shm | exec from /run/user/uid/ instead | bypass_proc_rules run-safe |
| 25 Fileless execution | shellcode via mmap, no execve | exe_from_memfd_bypass sc, proc_ghost ghost-sc |
| all | drain ringbuf or remove scap.ko | ringbuf_o, kmod_unload |

Contributing

Open a PR. Single-purpose tools, raw syscalls, no new dependencies.

Legal

This project is intended strictly for security research, authorized penetration testing, CTF competitions, and defensi de. All techniques demonstrated here are documented in public security research and kernel documentation.

Do not use this toolkit against systems you do not own or ha written authorization to test. Unauthorized use may the Computer Fraud and Abuse Act (CFAA), the EU Directive on Attacks Against Information Systems, and equi laws in your jurisdiction.

The authors assume no liability for misuse. By using this software you agree that you are solely responsible for compliance with applicable laws.

项目信息

开发语言：C

Star 数：287

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Post-exploitation and evasion research toolkit for Linux.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。