Linux kernel rootkits

Linux kernel rootkits

1337kit
A kernel rootkit for educational purposes that demonstrates various techniques to hide processes, files, and achieve privilege escalation.
Reptile
A Linux rootkit focusing on hiding itself, backdoor creation, and maintaining persistence while being lightweight and configurable.
KoviD
A kernel module showcasing malicious techniques like hiding files, processes, and network activities for rootkit-like functionality.
linux-syscall-hook-rootkit
Demonstrates syscall table hooking to intercept and manipulate system calls for stealth and privilege escalation.
TripleCross
A stealthy container escape and privilege escalation tool leveraging eBPF for hiding malicious activities.
ebpf_maps_hooking
A proof of concept demonstrating the use of eBPF maps for hooking and modifying kernel behavior dynamically.
kopycat
A rootkit leveraging syscall hooking to hide processes, files, and perform privilege escalation for Linux systems.
Diamorphine
A simple Linux LKM rootkit for hiding files, processes, and achieving stealth operations on a compromised system.
kernel-inline-hook
A kernel-level inline hooking framework designed for intercepting and modifying function execution flow.
ftrace-hook
A framework that uses ftrace for hooking kernel functions to implement debugging, monitoring, or malicious functionality.
kernel-hook-framework
A modular framework for implementing kernel hooks to intercept and manipulate Linux kernel functionalities.
Netfilter-Hooks-Simple
A basic implementation of Netfilter hooks to demonstrate network packet interception and manipulation at the kernel level.
Immutable-file-linux
A kernel module designed to protect files from being modified or deleted by setting immutable attributes at the kernel level.
enyelkm
An example of a loadable kernel module implementing rootkit functionality such as hiding processes and files.
Diamorphine
A repeat mention of a lightweight rootkit for Linux, showcasing hiding and privilege escalation techniques.
kprobe_rootkit
Demonstrates the use of kprobes for implementing rootkit-like functionality such as process hiding and event interception.
LilyOfTheValley
A kernel rootkit implementing various stealth techniques, including syscall hooking and hidden network communication.
rkduck
A rootkit demonstrating anti-detection techniques using kernel-level hooks to hide its presence.
liinux
A Linux rootkit showcasing process hiding, network manipulation, and maintaining stealth for educational purposes.
DragonKing
A kernel rootkit with advanced hiding capabilities and features for bypassing detection mechanisms.
Rootkits-Playground
A repository for experimenting with Linux rootkit techniques in a controlled environment for educational purposes.
JynKbeast
A kernel rootkit focusing on demonstrating syscall hooking and process hiding capabilities.
wukong
A proof of concept for Linux rootkits focusing on stealth and privilege escalation techniques.
subversive
A lightweight rootkit with features like hiding files, processes, and privilege escalation using LKM.
Umbra
A kernel rootkit using eBPF to achieve stealth and dynamic kernel-level behavior modification.
kbeast
A demonstration of kernel abuse techniques for hiding malicious processes and achieving persistence.
Rootkit
A generic Linux rootkit for educational purposes, showcasing common techniques like hiding and privilege escalation.
SMM-Rootkit
A proof-of-concept rootkit operating in the System Management Mode (SMM) for stealth and advanced capabilities.
swiss_army_rootkit
A multifunctional rootkit with a wide array of capabilities, including hiding files, processes, and manipulating network traffic.
kprochide
A rootkit leveraging kernel process hiding techniques to evade detection.
bad-bpf
A repository demonstrating how eBPF can be used maliciously for stealth and rootkit-like behavior.
ebpf_exporter
A tool to collect and export performance metrics from Linux systems using eBPF for monitoring purposes.
bpf_study
A collection of examples and experiments with eBPF, including hooks and monitoring applications.
sshd_backdoor
A malicious proof-of-concept demonstrating a backdoored SSH daemon for maintaining unauthorized access.
randkit
A random toolkit containing examples and concepts for manipulating and hiding processes in Linux environments.
ebpf-signals
A project leveraging eBPF for capturing and analyzing signals sent to processes.
the_colonel
A kernel rootkit designed to hide processes and demonstrate stealth techniques.
Sutekh
A Linux kernel rootkit showcasing advanced stealth techniques, including file and process hiding.
kfile-over-icmp
A tool demonstrating file transfer over ICMP for stealth communication in compromised systems.
linux_rootkit
A minimal Linux rootkit for educational purposes that demonstrates basic stealth and privilege escalation techniques.
rootkit
A demonstration of rootkit techniques focused on hiding files, processes, and achieving persistence.
CoVirt
A proof of concept for virtualization-based rootkits demonstrating stealth and persistence capabilities.
loonix_syscall_hook
Demonstrates syscall hooking in Linux to intercept and manipulate system calls for malicious purposes.
hiding-cryptominers-linux-rootkit
A rootkit designed to hide the presence of cryptominers on a Linux system while maintaining stealth.
linux-rootkits
A collection of Linux rootkits showcasing various stealth and privilege escalation techniques.
KubeDagger
A Kubernetes attack toolkit simulating malicious activity and vulnerabilities in containerized environments.
EXEC_LKM
A kernel module for executing arbitrary user-mode commands from the kernel space.
linux-rootkit
A demonstration rootkit focused on hiding files and processes on Linux systems.
rkptum2013
A rootkit for educational purposes, showcasing process hiding and privilege escalation techniques.
TheSubZeroProject
A kernel-level proof of concept demonstrating privilege escalation and stealth techniques.
rooty
A lightweight rootkit for Linux showcasing hiding and privilege escalation methods.
research-rootkit
A repository for experimenting with various rootkit techniques on Linux for research purposes.
satan
A Linux rootkit demonstrating syscall hooking and process hiding techniques.
linux_rkit
A kernel module for Linux showcasing rootkit functionality such as file and process hiding.
kernel-based-keylogger-for-Linux
A keylogger operating at the kernel level to capture keystrokes on Linux systems.
superhide
A rootkit designed to demonstrate process and file hiding capabilities in Linux environments.
conjob
A tool leveraging eBPF for monitoring cron jobs and system events for security or debugging purposes.
iptable_evil
A demonstration of malicious manipulation of iptables for stealth and unauthorized network activity.
root-of-all-evil
A rootkit demonstrating various stealth and manipulation techniques for educational purposes.
lkrg-bypass
A proof-of-concept tool demonstrating methods to bypass the Linux Kernel Runtime Guard (LKRG) protections.

Tags