rootkit

windows kernel security development

Webshell && Backdoor Collection

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

awesome-linux-rootkits

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x (x86/x86_64 and ARM64)

This is the list of all rootkits found so far on github and other sites.

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

Linux/Windows post-exploitation framework made by linux user

Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in metasploit and transparent. Even when it killed, it will re-run again. There always be a procces which while run another process,So we can assume that this procces is unstopable like a Ghost in The Shell

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

Hypervisor Memory Introspection Core Library

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

Kernel rootkit, that lives inside the Windows registry values data

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

Nidhogg is an all-in-one simple to use rootkit for red teams.

ebpfkit is a rootkit powered by eBPF

Tool to generate a Linux kernel module for custom rules with Netfilter hooking. (block ports, Hidden mode, firewall functions)

💣 just for fun ¯\_(ツ)_/¯

InfinityHookPro Win7 -> Win11 latest

Your interpreter isn’t safe anymore  —  The PHP module backdoor

A rootkit for Android. Based on "Android platform based linux kernel rootkit" from Phrack Issue 68

Shadow-Box: Lightweight and Practical Kernel Protector for x86 (Presented at BlackHat Asia 2017/2018, beVX 2018 and HITBSecConf 2017)

Elf binary infector written in Go.

A LKM rootkit for most newer kernel versions.

A Python 3 standalone Windows 10 / Linux Rootkit using Tor.

a summary of linux rootkits published on GitHub

Winsock accept() Backdoor Implant.