Hey security researchers and *red teamers*! Today, we're diving deep into **Furtex**, a Linux post-exploitation and evasion toolkit turning heads for its unique approach. Furtex is engineered to bypass modern detection systems by leveraging low-level Linux kernel capabilities: **io_uring** and **eBPF**.

## What Is Furtex? More Than Just Another Toolkit

**Furtex** isn't your run-of-the-mill toolkit relying on third-party libraries or *frameworks*. Instead, it's built from the ground up using *raw syscalls*. This approach allows it to interact directly with the kernel, bypassing abstraction layers that often serve as *hook* points for detection solutions. The project is under active development, even accepting *pull requests* from the community. You can join the Rootkit Researchers Discord community for further discussion.

Critical reminder: **Furtex** is intended exclusively for security research, authorized *penetration testing*, CTF competitions, and *defensive tooling* development. Never deploy it on systems you don't own or lack explicit written authorization to test. Misuse violates applicable cyber laws.

## Dissecting the Furtex Architecture

The toolkit is cleanly organized into several main directories, each targeting a specific facet of *post-exploitation* and *evasion*:

*   `io_uring/`: Houses 13 *tools* leveraging raw `io_uring` operations for file manipulation, *networking*, injection, and *exfiltration*. This is the beating heart of Furtex's *stealth* capabilities.
*   `bpf/`: Contains 15 *tools* for userspace manipulation of BPF maps and programs. Invaluable for understanding and modifying BPF behavior on a target system.
*   `ebpf/`: Holds 9 kernel-side BPF programs and 2 *runners* to load them. These are designed to operate in-kernel for reconnaissance or *evasion* purposes.
*   `edrs/`: The toolkit's largest component, packing 75 *tools* dedicated to EDR (Endpoint Detection and Response) *evasion* and general *post-exploitation*.
*   `techniques/`: Provides 13 specific *tools* to bypass all 25 standard rules in Falco, a popular behavior-based EDR.

## The Engine Under the Hood: io_uring and eBPF

Two pillars uphold **Furtex**: **io_uring** and **eBPF**. Grasping how they work is key to appreciating this toolkit's power.

### io_uring for Stealthy Operations

**io_uring** is Linux's newer asynchronous I/O interface, offering exceptional performance and flexibility. **Furtex**, however, weaponizes it for *evasion*. I/O requests submitted via `io_uring` SQEs are processed through the *kernel workqueue*. This means the `io_uring_enter(2)` syscall never touches the `sys_call_table` and never triggers `sys_enter_*` *tracepoints*. It automatically sidesteps most EDR *hooks* relying on:

*   `sys_call_table` pointer swapping.
*   *Livepatching* `native_sys_call` or `compat_sys_call`.
*   `sys_enter_*` *tracepoints*.

But `io_uring` alone doesn't cover every *bypass* scenario. For other *hook points* like *kprobes* or BPF LSM, Furtex supplies additional *tools*. For instance, `ftrace_enum` can nuke *kprobe hooks*, while `bpf_link_detach` can detach BPF LSM *links*.

### eBPF: Granular Kernel Control

**eBPF** (extended Berkeley Packet Filter) allows *userspace* programs to run safely inside the kernel. Furtex exploits **eBPF** to manipulate BPF maps, load kernel-side BPF programs, and interact with kernel components at a deep level. Capabilities include:

*   Dumping and wiping BPF map contents.
*   Injecting PIDs into EDR *allowlists*.
*   Detecting and detaching BPF LSM *hooks*.
*   Even hiding ports or PIDs from `/proc/net/tcp` or `getdents64` views.

## System Requirements

Building and running **Furtex** demands a specific Linux environment with the necessary *toolchain* and *headers*.

### Toolchain & Headers

| Tool / Package | Required For |
| :--- | :--- |
| `gcc` | All *userspace binaries* |
| `clang` | Kernel-side BPF programs (`ebpf/*.bpf.c`) |
| `make` | *Build* system |
| `linux-headers-$(uname -r)` | `<linux/bpf.h>`, `<linux/io_uring.h>`, related kernel headers |
| `libbpf-dev` | `<bpf/bpf_helpers.h>` and related funcs in `ebpf/` programs |
| `bpftool` | Generating `vmlinux.h` via `make vmlinux` inside `ebpf/` (requires `CONFIG_DEBUG_INFO_BTF=y` in kernel) |

On Debian, Kali, or Ubuntu, install the stack with:

```bash
sudo apt install gcc clang make linux-headers-$(uname -r) libbpf-dev bpftool
```

### Kernel Versions & Capabilities

**Furtex** taps into varying kernel features, so your kernel version dictates tool availability. Many *tools* also require specific Linux capabilities, typically needing `root` or `CAP_SYS_ADMIN` pre-kernel 5.8.

| Minimum Kernel Version | Features Unlocked |
| :--- | :--- |
| 5.4 | Basic `io_uring`, BPF map iteration |
| 5.6 | `IORING_OP_OPENAT`, `IORING_OP_STATX`, `pidfd_getfd` |
| 5.8 | `CAP_BPF` + `CAP_PERFMON` split (replacing `CAP_SYS_ADMIN` for BPF) |
| 5.9 | `BPF_LINK_DETACH` |
| 5.19 | `IORING_OP_SOCKET` (used by `af_packet_send`, `dns_exfil`, etc.) |

| Capability | Tools Requiring It |
| :--- | :--- |
| `CAP_BPF` | All `bpf/` *tools*, `ebpf/` *loaders* |
| `CAP_PERFMON` | `ebpf/` *tracepoint* and *kprobe* programs |
| `CAP_NET_RAW` | `icmp_tunnel`, `af_packet_shell`, `skf_c2_runner`, `icmp_trigger` |
| `CAP_NET_ADMIN` | `xdp_socket_send`, `netfilter_flush` |
| `CAP_AUDIT_CONTROL` | `audit_kill` |

## Building Furtex

The build process is straightforward via `make`:

```bash
make all      # Build all binaries
make uring    # Build io_uring/ tools only
make bpf      # Build bpf/ userspace tools
make ebpf     # Build kernel-side BPF programs (requires clang + libbpf)
make edrs     # Build all edrs/ binaries
make techniques # Build Falco bypass tools
make clean    # Remove all binaries
```

The `edrs/` directory has its own `Makefile` separating binaries by privilege requirements:

```bash
cd edrs && make priv    # For tools needing root / CAP_*
cd edrs && make unpriv  # For tools needing no privileges
```

## Exploring EDR Evasion Capabilities

The `edrs/` directory is the core of **Furtex**'s *evasion* muscle. With 75 *tools*, it offers a vast arsenal for dodging EDR detection. Standout examples include:

*   `edr_recon`: Detects EDRs from 12 vendors by scanning processes, artifacts, modules, BPF, and *kprobes*.
*   `audit_kill`: Disables or throttles Linux audit logging via `NETLINK_AUDIT`.
*   `ftrace_enum`: Enumerates and removes *kprobe* or *ftrace hooks*.
*   `livepatch_bypass`: Uses `io_uring` to bypass *livepatch hooks* on the *syscall dispatcher*.
*   `af_packet_shell`: Raw Ethernet C2 bypassing `netfilter OUTPUT`.
*   `memfd_userexec`: Executes ELF from *stdin* to `memfd` without traditional `execve`.
*   `hollow_proc`: Performs *process hollowing* with a decoy name in `ps`.
*   `pidfd_steal`: Steals open *file descriptors* from other processes via `pidfd_getfd`.

## Targeting Falco: A Specific Case Study

The `techniques/` directory specifically targets Falco, the popular behavioral threat detection engine, bypassing all 25 *default* rules. Furtex attacks Falco bypass from two primary vectors:

*   **Axis A (Prevent Event):** Stop the *event* from reaching Falco entirely. Example: `io_uring` bypassing `sys_enter_*` *tracepoints*, or silently draining/flooding the Falco *ring buffer*.
*   **Axis B (Evade Rule Condition):** The *event* reaches Falco, but the rule condition fails due to data manipulation. Examples: Process name spoofing (`proc.name spoof`), *path pivot*, or alternative *flag* usage.

Sample tools and bypassed Falco rules:

| Falco Rule | Bypass Method (Axis) | Tool Used |
| :--- | :--- | :--- |
| 1 Directory traversal monitored file read | `io_uring` OPENAT (A) | `uring_ops cat`, `per_rule_bypass dir-traversal` |
| 3 Read sensitive file untrusted | `io_uring` or `prctl` (A/B) | `uring_ops creds`, `bypass_file_rules read-masked` |
| 7 Contact K8S API Server | `io_uring` CONNECT (A) | `uring_ops shell`, `per_rule_bypass k8s-connect` |
| 10 Clear Log Activities | `ftruncate` without `O_TRUNC` (B) | `bypass_file_rules log-clear` |
| 18 Detect release_agent Escape | `io_uring` OPENAT+WRITE (A) | `cgroup_escape proof/shell`, `uring_ops write` |
| 25 Fileless execution via memfd_create | Shellcode via `mmap`, no `execve` (B) | `exe_from_memfd_bypass sc`, `proc_ghost ghost-sc` |
| All Rules | Drain *ring buffer* or remove `scap.ko` (A) | `ringbuf_overflow`, `kmod_unload` |

## Critical Warning

As stated, **Furtex** is a potent toolkit demanding extreme caution and responsibility. All techniques demonstrated stem from public security research and kernel documentation. Misuse carries serious legal consequences. The **Furtex** developers accept zero liability for any abuse. By using this software, you agree you are fully responsible for complying with applicable laws.

## Reference

*   https://github.com/MatheuZSecurity/Furtex

Dive deep into Furtex, an innovative Linux post-exploitation and evasion toolkit leveraging io_uring and eBPF for stealth operations, EDR bypass, and advanced security research.

Unmasking Furtex: The Next-Gen Linux Post-Exploitation Toolkit Weaponizing io_uring and eBPF

Reggi

Most enterprise security architectures look bulletproof on paper, right up until a real adversary runs an actual exploit chain against them. Compliance audits and static checklists only verify whether technical controls exist. They never tell you whether those controls can survive an active, targeted breach attempt. Red Teams bridge that operational gap by adopting the exact tactics, techniques, and procedures of real threat actors, stress-testing detection pipelines and validating defensive assumptions before a breach occurs.

To execute high-fidelity threat simulations, offensive operators rely on a curated, battle-tested toolset spanning the full lifecycle of an attack.

### The Attack Lifecycle and Tool Hierarchy

A disciplined offensive operation follows a structured kill chain. Operators do not fire exploits blindly into production systems. They methodically advance from passive reconnaissance to full post-exploitation control. 

| Attack Phase | Operational Objective | Core Tooling |
| :--- | :--- | :--- |
| **Information Gathering (OSINT)** | Map the external attack surface and correlate entities | Nmap, Maltego |
| **Vulnerability Scanning** | Identify unpatched vulnerabilities and misconfigurations | Nessus, OpenVAS |
| **Exploitation** | Weaponize vulnerabilities to achieve initial access | Metasploit Framework, Burp Suite |
| **Post-Exploitation** | Harvest credentials, maintain persistence, and pivot | Mimikatz, PowerSploit |
| **Social Engineering** | Exploit the human attack surface to bypass technical barriers | Social-Engineer Toolkit (SET) |

### 1. Reconnaissance and Intelligence Gathering

Everything starts with intelligence. Before interacting with defensive perimeters, operators collect data to map network footprints, domain architectures, and corporate relationships.

#### Nmap (Network Mapper)
Network visibility is the core prerequisite for any network assessment. Nmap sweeps targets to discover active hosts, identify open TCP and UDP ports, and fingerprint operating systems alongside their running application services.

```bash
nmap -sV target.com
```

By probing response packets, Nmap determines exact software versions. This exposes outdated network daemons running on perimeter edge nodes and gives operators the precise intelligence needed to plan downstream exploitation steps.

#### Maltego
Infrastructure is rarely isolated from the organization that operates it. Maltego handles open-source intelligence aggregation by visualizing complex entity graphs across individuals, domains, corporate registries, and network infrastructure. It exposes non-obvious pathways, revealing how secondary domains or public personnel profiles link back to prime targets.

### 2. Automated Vulnerability Assessment

Once the infrastructure blueprint is complete, the operational focus shifts to identifying misconfigurations, unpatched zero-days, and known CVEs.

#### Nessus and OpenVAS
Automated scanners such as Nessus and OpenVAS establish a baseline of common enterprise vulnerabilities. They scan network segments to flag unpatched services, default configurations, and known vulnerabilities. Rather than manually testing thousands of ports, operators use these engines to generate prioritized attack targets, spotlighting low-hanging fruit across corporate estates.

### 3. Exploitation and Weaponization

Exploitation converts a discovered vulnerability into a functional beachhead inside the network perimeter.

#### Metasploit Framework
The Metasploit Framework provides an extensive ecosystem of weaponized exploits, staging modules, and auxiliary tools. 

```bash
msfconsole
```

Metasploit provides a modular, reliable framework for launching payloads against known software vulnerabilities. It abstracts away the low-level mechanics of memory manipulation and shellcode injection, letting operators focus on validating system exposure.

#### Burp Suite
Because modern architectures rely heavily on browser-based interfaces, Burp Suite serves as the primary workbench for web application assessments. Operating as an intercepting HTTP proxy, it allows operators to inspect, manipulate, and replay raw web traffic. This enables in-depth manual and automated testing for authorization flaws, injection bugs, and authentication bypasses within custom web applications.

### 4. Post-Exploitation, Persistence, and Lateral Movement

Initial access is only the first step. To simulate full-scale enterprise compromise, operators must extract credentials, escalate local privileges, and move laterally through internal segments.

#### Mimikatz
Windows domains often rely on Single Sign-On and session tokens cached directly in volatile memory. Mimikatz targets the Local Security Authority Subsystem Service (LSASS) process, extracting plaintext credentials, NTLM hashes, and Kerberos tickets directly from memory. These harvested credentials allow operators to pivot laterally across the Active Directory environment without triggering traditional exploit detections.

#### PowerSploit
To evade conventional endpoint detection while navigating enterprise environments, operators rely on native system utilities. PowerSploit is a curated framework of PowerShell modules designed for local privilege escalation, memory reconnaissance, and defensive evasion. By executing directly in memory via built-in system shells, it demonstrates how attackers leverage native administration tooling to live off the land.

### 5. Social Engineering

Hardened technical perimeters often force adversaries to target the human layer instead.

#### Social-Engineer Toolkit (SET)
The Social-Engineer Toolkit (SET) automates the operational mechanics of human-centric attack vectors. It provides automated workflows for spear-phishing campaigns, credential harvesting web interfaces, and watering-hole scenarios. SET demonstrates how simple human manipulation can render external firewall rules and technical access controls completely irrelevant.

### Operational Discipline: Rules of Engagement

The difference between a criminal intrusion and a professional Red Team operation comes down to authorization and discipline. The tools in this arsenal are inherently dual-use. Operating them requires strict adherence to defined Rules of Engagement, explicit written consent, and strict boundary enforcement. Running offensive toolchains without written authorization is illegal and counterproductive to enterprise security.

### Engineering a Resilient Security Posture

Mastering this offensive stack is essential for building resilient systems. Platforms like Kali Linux package these tools into ready-to-deploy environments, allowing engineers to practice threat modeling, exploit mechanics, and post-exploitation monitoring. By systematically leveraging the Red Team arsenal, security teams evaluate architectures through the eyes of an attacker, turning reactive defense into proactive operational resilience.

## Reference
* https://github.com/A-poc/RedTeam-Tools

Discover how Red Teams stress-test security postures using an offensive arsenal. Explore essential tools from OSINT and vuln scanning to post-exploitation frameworks.

Why Your Defenses Fail Under Fire: Dissecting the Modern Red Team Toolchain

If an attacker secures root access on your Linux server, changing every user password will not save you. Pluggable Authentication Modules (PAM) sit directly in the authentication path, processing plaintext credentials in transit before hashes are ever computed or evaluated. When malware hooks this layer, the operating system's primary gatekeeper becomes the adversary's most reliable collection agent.

Security researchers have detailed **PamDOORa**, a specialized post-exploitation toolkit targeting the Linux PAM stack. Initially surfaced on the Russian cybercrime forum "Rehub" by an actor operating under the handle "darkworm," the implant represents a shift from crude proof-of-concept scripts to a modular, operator-grade persistence engine. 

### Anatomy of an In-Path Authentication Hook

PamDOORa targets Linux (x86_64) systems and represents the second known Linux backdoor purposefully built around the PAM framework, following DopePAM. 

Understanding why this architecture is devastating requires looking at how PAM operates:

```
[ Inbound SSH / Auth Request ]
             │
             ▼
    ┌──────────────────┐
    │  OpenSSH Daemon  │
    └────────┬─────────┘
             │ (Hands off plaintext auth token)
             ▼
    ┌──────────────────┐
    │    PAM Stack     │ ◄─── [ PamDOORa Hook Injected Here ]
    └────────┬─────────┘        ├─ Intercepts Plaintext Password
             │                  ├─ Evaluates "Magic Password" Bypass
             ▼                  └─ Scrub Forensic Logs
    ┌──────────────────┐
    │ System Auth / DB │
    └──────────────────┘
```

PAM allows administrators to configure pluggable authentication schemes without rewriting core system daemons. However, because PAM modules execute with full root privileges and must handle unhashed authentication secrets directly in transit, an in-path compromise gives an attacker absolute leverage. 

PamDOORa abuses this design to execute three primary functions:

1. **Passive Credential Harvesting**: Because PAM handles authentication material in memory prior to hashing, the implant captures credentials from every legitimate user authenticating against the compromised host.
2. **Persistent SSH Ingress**: The module implements a "magic" password mechanism tied to a specific TCP port trigger, granting unauthorized administrative access regardless of whether legitimate user credentials rotate.
3. **Anti-Forensic Log Tampering**: The implant systematically alters authentication logs, stripping out traces of unauthorized access and raising the barrier for incident responders.

### Configuration Abuse and the `pam_exec` Vector

Beyond custom compiled modules, standard PAM functionality provides native primitives that attackers frequently exploit for identical outcomes. Security vendor Group-IB highlighted that the standard `pam_exec` module, designed to run external binaries during authentication phases, remains a primary attack vector.

When an attacker establishes initial root access, they can modify SSH authentication rules within the PAM configuration files to invoke scripts via `pam_exec`. This pattern exposes a critical structural risk:

*   **Privileged Execution Context**: External scripts executed by `pam_exec` run with elevated privileges.
*   **Shell Spawning**: Attackers can abuse these hooks to grant a privileged shell directly on the host during standard connection attempts.
*   **Zero Credential Footprint**: Malicious scripts can intercept the plaintext variables passed down the PAM pipeline without interacting with traditional disk-based credential stores.

PamDOORa packages these techniques into a cohesive framework. Flare.io researcher Assaf Morag notes that while techniques like PAM hooks, credential theft, and log sanitization are well-documented individually, PamDOORa integrates them into a modular implant equipped with a pipeline builder, anti-debugging capabilities, and network-based triggers.

### Underground Economics: Pricing the Implant

PamDOORa's market trajectory on illicit forums reflects shifting dynamics in the post-exploitation tooling trade.

| Date | Pricing (USD) | Market Movement |
| :--- | :--- | :--- |
| March 17, 2026 | $1,600 | Initial release by "darkworm" on Rehub |
| April 9, 2026 | $900 | ~50% price reduction |

A price drop of nearly 50% within weeks of release points to one of two market dynamics: either initial demand was weaker than anticipated, or the seller pivoted toward driving higher transaction volume among lower-tier operators.

### Engineering Takeaways

There is currently no evidence of PamDOORa deployed in active, in-the-wild campaigns. The toolkit remains fundamentally a post-exploitation system: an attacker must first obtain root privileges to install and configure the malicious PAM module.

However, its emergence underscores an essential reality of infrastructure engineering. If integrity verification stops at user account audits, in-memory credential harvesting within the PAM subsystem will remain completely invisible. Securing Linux infrastructure requires auditing PAM configuration files, validating module binaries against known checksums, and treating the core authentication pipeline as an active attack surface.

### References
* https://thehackernews.com/2026/05/new-linux-pamdoora-backdoor-uses-pam.html

Security researchers unpack PamDOORa, an operator-grade Linux PAM backdoor with magic-password SSH persistence, anti-forensics, and plaintext credential harvesting.

Weaponizing the Linux Auth Stack: Inside the Architecture of the PamDOORa Backdoor

Eliminate context switching and manage custom domain email directly inside Gmail. Configure unified inbound ingestion and Send As permissions seamlessly.

The Unified Inbox Architecture: Routing Custom Domain Webmail Through Gmail

Eliminate manual rotation bottlenecks, thermal lag, and biological variance by building an automated, headless AC-powered egg incubator setup.

Stop Acting as a Manual Cron Job: Engineering an Automated AC-Powered Incubator

Ditch mains AC for a stable, low-voltage DC egg incubator. Learn how dedicated temp and humidity control modules optimize poultry yields.

Why AC Mains Are Ruining Your Hatch Rates: Building a Reliable Low-Voltage DC Incubator

A technical systems breakdown of battery-powered ride-on car assembly for ages 2 to 7 (50kg max), covering safety envelopes, parental remote control, and multimedia architecture.

Architecting the Scaled EV: Remote Override Logic and Multimedia Integration for Electric Ride-On Chassis

Learn how to build a reliable smart power strip using NodeMCU and Blynk for wireless and voice-controlled electrical management.

Why Remote Power Switching Fails in Hardware Prototypes and How NodeMCU with Blynk Solves It

Fix persistent macOS bugs, wipe disk bloat, or prep for resale. Master Internet Recovery (Command+Option+R), APFS reformatting, and clean installation.

#post-exploitation

Getting Lastest Post..

Trending This Month