HN
Furtex: Post-exploitation, rootkit and evasion research toolkit for Linux
Post-exploitation and evasion research toolkit for Linux, built around io_uring and eBPF. No liburing, no frameworks, raw syscalls throughout.
For authorized research and red team engagements only. Don't run this on systems you don't own.
BTF must be enabled in the kernel ( CONFIG_DEBUG_INFO_BTF=y ) to run make vmlinux for ebpf/ programs.
On distros with older libc-dev headers (Ubuntu 22.04 etc.) you may need #ifndef IORING_OP_SOCKET / #define IORING_OP_SOCKET 45 . Already handled in this repo.
edrs/ has its own sub-Makefile with ~75 binaries split by privilege:
See PRIVILEGES.md for the full breakdown.