Why This Matters
Furtex is a specialized Linux toolkit designed for post-exploitation, rootkit, and evasion research, emphasizing raw syscalls and minimal dependencies. Its focus on io_uring and eBPF makes it a powerful resource for security researchers and red teams to analyze and develop advanced evasion techniques. This toolset enhances the capabilities for Linux security testing, highlighting the importance of understanding kernel-level operations and evasion strategies in cybersecurity.
Key Takeaways
- Furtex offers a comprehensive suite of tools for Linux post-exploitation and evasion research built around io_uring and eBPF.
- The toolkit requires specific kernel versions and capabilities, emphasizing the need for updated Linux environments for effective use.
- Designed for authorized research only, Furtex underscores the importance of responsible security testing and kernel-level understanding.
Furtex
Post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF. No liburing, no frameworks, raw syscalls throughout.
More tools soon. PRs are welcome.
Join in Rootkit Researchers
For authorized research and red team engagements only. Don't run this on systems you don't own.
Furtex/ ├── io_uring/ raw io_uring ops: file, net, injection, exfil (13 tools) ├── bpf/ BPF map and program tooling (15 tools) ├── ebpf/ BPF-side programs and loaders (9 programs + 2 runners) ├── edrs/ EDR evasion and post-exploitation (75 tools) └── techniques/ Falco-specific bypass, all 25 default rules (13 tools)
Requirements
Toolchain
tool needed for gcc all userspace binaries clang ebpf/*.bpf.c BPF-side programs make build system
Headers and libraries
... continue reading
GoKawiil