Furtex是一款面向Linux平台的后渗透和规避研究工具包，基于io_uring和eBPF技术构建 1。该项目包含137个工具和技术实现，涵盖文件操作、网络通信、EDR规避和Falco检测绕过等功能 1。
工具包由多个模块组成：io_uring模块包含13个工具，bpf模块15个工具，ebpf模块9个程序和2个运行器，edrs模块75个工具，techniques模块13个工具 1。
系统要求方面，该项目最低支持Linux 5.4内核以获得io_uring基础功能 1。运行时需要CAP_BPF、CAP_PERFMON、CAP_NET_RAW、CAP_NET_ADMIN、CAP_AUDIT_CONTROL等权限 1。编译依赖包括gcc、clang、make、linux-headers、libbpf-dev和bpftool 1。
从技术优势看，io_uring可绕过sys_call_table指针替换、livepatch钩子和sys_enter_*追踪点 1。在检测规避方面，该工具包覆盖了25条Falco默认规则的绕过技术 1。
项目明确标注了使用限制："仅用于授权安全研究和红队测试。请勿在未授权的系统上运行。" 1
Furtex is an open-source toolkit designed for post-exploitation, rootkit development, and evasion research on Linux systems 1. Built on io_uring and eBPF technologies, the project comprises 137 tools and technical implementations spanning file operations, network communications, EDR evasion, and detection bypass capabilities 1.
The toolkit is organized into five primary modules 1. The io_uring module contains 13 tools, while the bpf module includes 15 tools 1. The ebpf module provides 9 programs plus 2 runners, the edrs module offers 75 tools, and the techniques module contains 13 tools 1. Notably, the project covers 25 default Falco rule bypasses 1.
System requirements include a minimum Linux kernel version of 5.4 to support io_uring functionality 1. The toolkit requires specific capabilities including CAP_BPF, CAP_PERFMON, CAP_NET_RAW, CAP_NET_ADMIN, and CAP_AUDIT_CONTROL 1. Compilation dependencies encompass gcc, clang, make, linux-headers, libbpf-dev, and bpftool 1.
A key technical advantage of io_uring is its ability to circumvent sys_call_table pointer replacement, livepatch hooks, and sys_enter_* tracepoints 1.
The project explicitly restricts its use, stating: "For authorized research and red team engagements only. Don't run this on systems you don't own." 1
评论
还没有评论，欢迎留下第一条。