Furtex \u2013 Linux Toolkit for Post-Exploitation and Evasion for Security Researchers and Red Teamers
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A new open-source project, Furtex, has emerged as a Linux-focused post-exploitation and evasion research toolkit<\/a> for authorized security researchers and red-team operators.<\/p>\n The project combines raw io_uring system calls, BPF and eBPF tooling, and EDR-evasion research utilities without relying on liburing or larger frameworks.<\/p>\n Furtex is a collection of single-purpose tools designed to demonstrate how modern Linux telemetry, kernel monitoring, and endpoint defenses can be tested.<\/p>\n The repository explicitly states that it is only for authorized research, penetration testing<\/a>, CTF environments, and defensive development.<\/p>\n Furtex is divided into five main areas: io_uring, bpf, ebpf, edrs, and techniques. The io_uring section contains 13 tools that use raw kernel interfaces for file, networking, process injection, and data transfer operations.<\/p>\n Its stated research focus is the visibility gap created when operations are submitted through io_uring work queues rather than traditional syscall-dispatch paths.<\/p>\n The project claims that certain io_uring operations may not trigger sys_enter_* tracepoints or pass through hooks placed on syscall-table dispatch functions.<\/p>\n This matters because security products often collect Linux telemetry through syscall tracing, kprobes, eBPF programs, audit rules, or user-space interception.<\/p>\nFurtex: Linux Post-Exploitation Toolkit<\/strong><\/h2>\n