rvbbit-arsenal

RVBBIT Arsenal: The Ultimate Offense & Defense Duality Overview This repository houses two sides of the same coin: attack/ – Project RVBBIT, a classic Linux kernel rootkit with embedded miner and network worm. defense/ – RvbbitSafe, the definitive countermeasure that detects, neutralizes, and...

project-rvbbit

Project RVBBIT: Linux Kernel Rootkit Proof-of-Concept 📖 Overview Project RVBBIT is an educational proof-of-concept demonstrating advanced stealth techniques used by Linux kernel rootkits. It is intended exclusively for cybersecurity research, defensive training, and understanding how modern...

rootkit-detection-ebpf-time-trace

Rootkit Detection with eBPF Time Tracing This repository contains code to collect time measurements of kernel functions that are manipulated by rootkits when they hide files, as well as a semi-supervised detection method that analyzes shifts of kernel function execution times. This implementation...

bat

Behavioral Adversary Tracer BAT BAT is a realistic, evolving adversary threat model for Linux and Windows. It is not a C2 framework and it is not a rootkit. It is a complete threat simulation platform that integrates C2 communication, kernel-level stealth rootkit modules, userspace evasion,...

Diamorphine

Diamorphine Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x x86/x8664 and ARM64 Features When loaded, the module starts invisible; Hide/unhide any process by sending a signal 31; Sending a signal 63to any pid makes the module become invisible; Sending a signal 64to any pid...

Singularity

Singularity - Stealthy Linux Kernel Rootkit "Shall we give forensics a little work?" This project was inspired by a very special woman to me: Mocinha Singularity is a powerful Linux Kernel Module LKM rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through...

ksentinel

ksentinel - Kernel Syscalls Integrity Monitor Overview ksentinel monitors critical kernel functions and the syscall table for unauthorized modifications. It detects common syscalls that are targeted by most rootkits including ftrace hooks, kprobes, and syscall table hijacking. Features Function...

VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

Nidhogg

Nidhogg Nidhogg is a multi-functional rootkit to showcase the variety of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with...

SPiCa

SPiCa System Process Integrity & Cross-view Analysis "I'm going to sing, so shine bright, SPiCa..." SPiCa is an eBPF-based Linux rootkit detector written in Rust. The name comes from the Hatsune Miku song SPiCa and the star it references — Spica Alpha Virginis, the brightest point in Virgo. What...

Codeine

Codeine .o88b. .d88b. d8888b. d88888b d888888b d8b db d88888b d8P Y8 .8P Y8. 88 8D 88' 88' 888o 88 88' 8P 88 88 88 88 88ooooo 88 88V8o 88 88ooooo 8b 88 88 88 88 88 88 88 V8o88 88 Y8b d8 8b d8' 88 .8D 88. .88. 88 V888 88. Y88P' Y88P' Y8888D' Y88888P Y888888P VP V8P Y88888P Codeine は Linux LKM...

shadow

shadow-rs 🦀 shadow-rs は Rust で書かれた Windows カーネルルートキットであり、Rust の安全性とパフォーマンスの特性を活用しながら、高度なカーネル操作テクニックを実証します。このプロジェクトは教育および研究目的を意図しています。 目次 お知らせ 機能 インストール 対応プラットフォーム ビルド手順 ドライバ クライアント セットアップ手順 テストモードの有効化 Windbg によるデバッグ サービスの作成/開始 免責事項 shadow-rs への貢献 参考 ライセンス 貢献者 お知らせ !IMPORTANT このプロジェクトは開発中です。 機能 プロ...

red-detector

Red-Detector Description Scan your EC2 instance to find its vulnerabilities using Vuls https://vuls.io/en/. Audit your EC2 instance to find security misconfigurations using Lynis https://cisofy.com/solutions/lynis. Scan your EC2 instance for signs of a rootkit using Chkrootkit...

red-detector

Red-Detector 説明 Vuls https://vuls.io/en/ を使用して EC2 インスタンスの脆弱性をスキャンします。 Lynis https://cisofy.com/solutions/lynis を使用して EC2 インスタンスのセキュリティ設定ミスを監査します。 Chkrootkit http://www.chkrootkit.org/ を使用して EC2 インスタンスにルートキットの兆候がないかスキャンします。 要件 1. 以下に示す EC2 アクションが設定された AWS アカウント。これらの要件を含むポリシーは...

Vegile

Vegile - Ghost In The Shell Vegile is a tool for Post exploitation Techniques in linux. Post Exploitation techniques will ensure that we maintain some level of access and can potentially lead to deeper footholds into our targets trusted network. Donate If this project is very helpful to your...

r77-rootkit

r77 ルートキット ファイルレス ring 3 ルートキット r77は、すべてを隠蔽するring 3ルートキットです： ファイル、ディレクトリ プロセスとCPU/GPU使用率 レジストリキーと値 サービス TCPおよびUDP接続 ジャンクション、名前付きパイプ、スケジュールタスク プレフィックスによる隠蔽 "$77"で始まるすべてのものが隠蔽されます。 設定システム 動的な設定システムにより、プロセスをPID や名前 で、ファイルシステムアイテムをフルパス で、特定のポートのTCPおよびUDP接続などを隠蔽できます。...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

freebsd_kernel_hacking

FreeBSD Kernel Hacking Exercises from Joseph Kong's Designing BSD Rootkits, updated for FreeBSD 11/12. Even though the book is over 10 years old, it's highly recommended as it's quite a challenge to update the source code provided in the book to work on modern releases. Further Resources:...

BlackLotus-analysis-stage2-bootkit-rootkit-stage

BlackLotus-analysis-stage2-bootkit-rootkit-stage BlackLotus ステージ2 ブートキット-ルートキット解析 この神がかった代物に踏み込む前に信じてくれ、これは神の御心なしには誰にも成し得ない神がかった代物だ少なくとも私の意見では、ブートキットファイルのハッシュをここに示す まず最初に、これが正常なシステムの見え方だ C:\Windows\system32BCDEdit Windows Boot Manager identifier bootmgr device partition=\Device\HarddiskVolume9 pa...

DynastyPersist

DynastyPersist 1.5 DynastyPersist: A streamlined tool for achieving Linux persistence effortlessly. Supports KoTH, Battlegrounds and Pentest Operations Install • Documentation • Usage Documentation FEATURES Features| Description ---|--- SSH Key Generation| Automatically generates SSH keys for...