windows kernel security development

Webshell && Backdoor Collection

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

This is the list of all rootkits found so far on github and other sites.

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x (x86/x86_64 and ARM64)

Windows driver with usermode interface which can hide objects of file-system and registry, protect processes and etc

Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

awesome-linux-rootkits

This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in metasploit and transparent. Even when it killed, it will re-run again. There always be a procces which while run another process,So we can assume that this procces is unstopable like a Ghost in The Shell

Hypervisor Memory Introspection Core Library

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

PCI Express DIY hacking toolkit for Xilinx SP605

Your interpreter isn’t safe anymore  —  The PHP module backdoor

💣 just for fun ¯\_(ツ)_/¯

Shadow-Box: Lightweight and Practical Kernel Protector for x86 (Presented at BlackHat Asia 2017/2018, beVX 2018 and HITBSecConf 2017)

Tool to generate a Linux kernel module for custom rules with Netfilter hooking. (block ports, Hidden mode, functions to protect etc)

A rootkit for Android. Based on "Android platform based linux kernel rootkit" from Phrack Issue 68

www.rootkit.com users section mirror, sql database dump, and a few other files/rootkits.

a summary of linux rootkits published on GitHub

A LKM rootkit for most newer kernel versions.

Linux v4.x.x Rootkit

Shadow-Box: Lightweight and Practical Kernel Protector for ARM (Presented at BlackHat Asia 2018)

An example rootkit that gives a userland process root permissions

LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.

Protects deletion of files with a specified extension using a kernel-mode driver.

A practical tool for bytecode manipulation and creating Managed Code Rootkits (MCRs) in the Java Runtime Environment

Rootkit Detector for UNIX

Fend off malware at Qubes VM startup

Example of hooking a linux systemcall

Linux Rootkits (4.x Kernel)