Full bidirectional relay with 50+ channel types. Kernel-level process masquerading. Argument memory zeroing. Multi-platform stealth.
$ ./conduit -Mk TCP-LISTEN:8080,fork TCP:10.0.0.5:80 & masquerading as [kworker/0:1] $ ps aux | grep conduit (no results) $ ps aux | grep kworker root 501 0.0 0.0 [kworker/0:1] $ ./conduit -Ms OPENSSL:server:443,verify=0 TCP-LISTEN:8080,fork masquerading as systemd-logind relay active — 2 channels
Process masquerading, argument hiding, and advanced stealth options. All SOCAT functionality preserved.
Platform-native APIs transform process identity. Linux prctl() for kernel workers. BSD setproctitle() for system services. Generic argv[] manipulation fallback.
Command-line arguments erased from /proc filesystem. Memory boundaries overwritten post-parse. Survives ps, top, htop inspection. Microsecond overhead.
Manipulate ns_last_pid to receive specific PIDs. Blend into low PID ranges. Mimic service restart behavior. Requires root.
Set oom_score_adj to -1000. Prevent Linux OOM killer termination under memory pressure. Persistent operations survive low-memory conditions.
TCP, UDP, UNIX, SSL/TLS, SOCKS, file, PTY — all 50+ data channel types. 100+ configuration options preserved. No functionality sacrificed for stealth.
Remove SSH_*, SUDO_*, DISPLAY, XAUTHORITY, and other forensic artifacts from process environment with -Me flag.
Native implementations for major platforms. Graceful degradation on unsupported systems.
Parse masquerade flag. Apply identity via platform-native API. Start SOCAT relay. Masquerading is transparent to relay logic.
Parse -M* masquerade flags, detect platform capabilities (prctl/setproctitle), then pass remaining arguments to SOCAT's standard parser.
Apply identity via prctl(PR_SET_NAME) on Linux, setproctitle() on BSD, or argv[] memory zeroing as generic fallback. Microsecond overhead.
Standard SOCAT bidirectional relay. All 50+ channel types operational. No performance degradation. Masquerading completely transparent to data flow.
Optional: PID targeting via ns_last_pid, OOM immunity via oom_score_adj, ephemeral port range, environment sanitization, time namespace matching.
Build from source with make. Single binary, zero runtime dependencies.
$ git clone https://github.com/Real-Fruit-Snacks/Conduit.git $ cd Conduit && make $ ./conduit --help $ ./conduit --list-masq
# Kernel worker masquerade $ ./conduit -Mk TCP-LISTEN:8080,fork TCP:backend:80 # SSH daemon with TLS $ ./conduit -MS OPENSSL:server:443 TCP:app:8443 # Full stealth: PID + OOM + env clean $ sudo ./conduit -Ms -Mp 500 -Mo -Me \ TCP-LISTEN:443 TCP:backend:443
ps aux — masqueraded process name/proc/pid/cmdline — arguments zeroedtop, htop — false identity displayedstrace, dtrace — syscall tracing