SOCAT relay that disappears from ps

Full bidirectional relay with 50+ channel types. Kernel-level process masquerading. Argument memory zeroing. Multi-platform stealth.

conduit
$ ./conduit -Mk TCP-LISTEN:8080,fork TCP:10.0.0.5:80 &
masquerading as [kworker/0:1]

$ ps aux | grep conduit
(no results)

$ ps aux | grep kworker
root       501  0.0  0.0  [kworker/0:1]

$ ./conduit -Ms OPENSSL:server:443,verify=0 TCP-LISTEN:8080,fork
masquerading as systemd-logind
relay active — 2 channels
0
Channel Types
0
Masquerade Presets
0
Platforms
0
SOCAT Options

Stealth built into SOCAT

Process masquerading, argument hiding, and advanced stealth options. All SOCAT functionality preserved.

Process Masquerading

Platform-native APIs transform process identity. Linux prctl() for kernel workers. BSD setproctitle() for system services. Generic argv[] manipulation fallback.

$ ./conduit -Mk TCP-LISTEN:8080,fork TCP:backend:80 # kernel worker
$ ./conduit -Ms TCP-LISTEN:8080,fork TCP:backend:80 # systemd-logind
$ ./conduit -MS TCP-LISTEN:2222 TCP:ssh:22 # sshd
7
Masquerade Presets

Argument Hiding

Command-line arguments erased from /proc filesystem. Memory boundaries overwritten post-parse. Survives ps, top, htop inspection. Microsecond overhead.

PID Targeting

Manipulate ns_last_pid to receive specific PIDs. Blend into low PID ranges. Mimic service restart behavior. Requires root.

OOM Immunity

Set oom_score_adj to -1000. Prevent Linux OOM killer termination under memory pressure. Persistent operations survive low-memory conditions.

50+
Channel Types

Full SOCAT Compatibility

TCP, UDP, UNIX, SSL/TLS, SOCKS, file, PTY — all 50+ data channel types. 100+ configuration options preserved. No functionality sacrificed for stealth.

$ ./conduit -Ms OPENSSL:server:443,verify=0 TCP-LISTEN:8080
$ ./conduit -Mk SOCKS4A:proxy:target:80 TCP-LISTEN:1080
$ ./conduit -Ms UNIX-CONNECT:/var/run/docker.sock TCP-LISTEN:2375

Environment Sanitization

Remove SSH_*, SUDO_*, DISPLAY, XAUTHORITY, and other forensic artifacts from process environment with -Me flag.

Platform support

Native implementations for major platforms. Graceful degradation on unsupported systems.

Linux prctl
FreeBSD
OpenBSD
macOS
TCP / UDP
UNIX Sockets
SSL / TLS
SOCKS Proxy
Argument Hiding
Process Masquerade
PID Targeting
OOM Immunity
Port Range Control
Env Sanitization
Time Matching
EDR Evasion
Traffic Hiding
Full   Limited   Not Supported

Three-stage execution

Parse masquerade flag. Apply identity via platform-native API. Start SOCAT relay. Masquerading is transparent to relay logic.

1

Option Parsing

Parse -M* masquerade flags, detect platform capabilities (prctl/setproctitle), then pass remaining arguments to SOCAT's standard parser.

2

Masquerade Setup

Apply identity via prctl(PR_SET_NAME) on Linux, setproctitle() on BSD, or argv[] memory zeroing as generic fallback. Microsecond overhead.

3

Relay Execution

Standard SOCAT bidirectional relay. All 50+ channel types operational. No performance degradation. Masquerading completely transparent to data flow.

4

Advanced Stealth

Optional: PID targeting via ns_last_pid, OOM immunity via oom_score_adj, ephemeral port range, environment sanitization, time namespace matching.

Build and deploy

Build from source with make. Single binary, zero runtime dependencies.

build.sh
$ git clone https://github.com/Real-Fruit-Snacks/Conduit.git
$ cd Conduit && make

$ ./conduit --help
$ ./conduit --list-masq
usage.sh
# Kernel worker masquerade
$ ./conduit -Mk TCP-LISTEN:8080,fork TCP:backend:80

# SSH daemon with TLS
$ ./conduit -MS OPENSSL:server:443 TCP:app:8443

# Full stealth: PID + OOM + env clean
$ sudo ./conduit -Ms -Mp 500 -Mo -Me \
  TCP-LISTEN:443 TCP:backend:443

Know the boundaries

Hidden From

  • ps aux — masqueraded process name
  • /proc/pid/cmdline — arguments zeroed
  • top, htop — false identity displayed
  • Basic process inspection — casual observation defeated

Visible To

  • strace, dtrace — syscall tracing
  • Network monitoring — traffic patterns unchanged
  • EDR / XDR — behavioral analysis
  • SELinux, AppArmor — kernel security modules
  • Memory forensics — arguments recoverable from RAM