VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

CVE-2024-26229-BOF

CVE-2024-26229 BOF Beacon Object File implementation of CVE-2024-26229 — Windows CSC driver local privilege escalation via DKOM token theft. Based on RalfHacker/CVE-2024-26229-exploit, converted to BOF with Dynamic Function Resolution DFR for use with C2 frameworks that support the Cobalt Strike...

project-rvbbit

Project RVBBIT: Linux Kernel Rootkit Proof-of-Concept 📖 Overview Project RVBBIT is an educational proof-of-concept demonstrating advanced stealth techniques used by Linux kernel rootkits. It is intended exclusively for cybersecurity research, defensive training, and understanding how modern...

Chaos-Rootkit

Chaos-Rootkit Chaos-Rootkit is an x64 Ring 0 rootkit i wrote to better understand kernel internals and rootkit techniques. Gui version Features Hide process: This feature allows you to hide processes from listing tools via DKOM. Elevate specific process privileges : This feature enables you to...

eop24-26229

Firebeam CVE-2024-26229 plugin A small firebeam kaine's risc-v vm plugin to exploit the CVE-2024-26229 vulnerability that utilizes a vulnerable IOCTL in csc.sys. The vulnerability is used to get kernel R/W memory access to corrupt the KTHREAD-PreviousMode and then to leveraging DKOM to achieve LP...

Exploit for Heap-based Buffer Overflow in Microsoft

Firebeam CVE-2024-26229 plugin A small firebeam kaine's risc...