antispy

AntiSpy English | 简体中文 A powerful anti rootkit toolkit AntiSpy is a free but powerful anti virus and rootkits toolkit. It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks. With its assistance,you can easily spot and...

ModTracer

ModTracer v1.0 ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again. Another way to make an LKM visible is using the imperius trick: https://github.com/MatheuZSecurity/Imperius Join in Rootkit Researchers Group https://discord.gg/66N5ZQppU7...

tcconfig

.. contents:: tcconfig :backlinks: top :depth: 2 Summary tcconfig is a tc command wrapper. Make it easy to set up traffic control of network bandwidth/latency/packet-loss/packet-corruption/etc. to a network-interface/Docker-containerveth. |PyPI pkg ver| |Supported Python ver| |CI status| |CodeQL|...

PF_RING

PFRING™ Introduction PFRING™ is a Linux kernel module and user-space framework that allows you to process packets at high-rates while providing you a consistent API for packet processing applications. Who needs PFRING™? Basically everyone who has to handle many packets per second. The term ‘many’...

wolfGuard

WolfGuard VPN with FIPS 140-3 cryptography WolfGuard is the wolfSSL FIPS-compliant refactor of Linux kernel-based WireGuard, originally designed and authored by Jason Donenfeld. Usage is essentially identical. There are two principal components to WolfGuard, the wolfguard.ko kernel module and the...

SYNwall

SYNwall Zero config IoT firewall. SYNwall is a project built for the time being as a Linux Kernel Module, to implement a transparent and no-config/no-maintenance firewall. You may want to have a look to the for an example of usage. Basics Usually IoT devices are out of a central control, with low...

multi_path

multipath - exploit for p0 issue 1558 CVE-2018-4241 @i41nbeer mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: // verify salen for AFINE...

insmod_block

insmodblock Linux: - - - - - - - By nu11secur1ty: https://github.com/nu11secur1ty/linux-nu11secur1ty Linux: - - - - - - - By nu11secur1ty: https://gitlab.com/nu11secur1ty/linux-nu11secur1ty Linux Kernel security modules by nu11secur1ty GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright...

ksentinel

ksentinel - Kernel Syscalls Integrity Monitor Overview ksentinel monitors critical kernel functions and the syscall table for unauthorized modifications. It detects common syscalls that are targeted by most rootkits including ftrace hooks, kprobes, and syscall table hijacking. Features Function...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ublk: resets kernel-owned devinfo fields in ublkctrladddev ublkctrladddev copies the userspace ublksrvctrldevinfo into ub-devinfo and then fixes up the fields owned by the driver; however, it fails to update -state and -ublksrvpi...

vcheck

vcheck Audit a remote Linux host over SSH for the Copy Fail and Dirty Frag kernel-module vulnerabilities and, optionally, apply mitigations: CVE| Name| Affected modules ---|---|--- CVE-2026-31431| Copy Fail| algifaead CVE-2026-43284| Dirty Frag IPsec| esp4, esp6, ipcomp4, ipcomp6, xfrmuser...

LiME

LiME Linux Memory Extractor A Loadable Kernel Module LKM for volatile memory acquisition from Linux and Linux-based devices, such as Android. LiME minimizes its interaction between user and kernel space processes during acquisition, producing memory captures that are more forensically sound than...

linux-root-kit

About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...

CVE-2026-31431_SCA_WAZUH

Wazuh SCA policy: Copy Fail CVE-2026-31431 This policy file: copy-fail-cve-2026-31431-policy.yml is designed to detect likely exposure and mitigation status for Copy Fail / CVE-2026-31431. What this policy checks 1. algifaead is disabled via modprobe policy. 2. algifaead is not currently loaded. ...

rootkit

Linux Rootkit A simple Linux kernel rootkit written for fun, not evil. Functionality The rootkit can do the following: Grant root privileges to a userland process Hide process by PID Unhide a previously hidden process by PID Hide files or directories by their name Unhide previously hidden files o...

F9360-CVE43499

SM-F9360 Galaxy Z Fold4 / q4q Bootloader-Unlock-Free KernelSU Root CVE-2026-43499 temporary root → LDPRELOAD channel bypasses DEFEX → non-LTO clang-12 build of kernelsu.ko → full su + KernelSU Manager functionality Status: ✅ Verified on real device on 2026-08-12 firmware F9360ZCSAIZF1, kernel...

cve-2017-2636-el

cve-2017-2636-el This role installs the workaround documented on https://access.redhat.com/security/cve/CVE-2017-2636 to blacklist the nhdlc module from being loaded. Requirements This role only applies to Red Hat Enterprise Linux versions 6 and 7, and variants CentOS, CloudLinux, etc. License MI...

ane

Asahi Neural Engine Reverse engineered Linux driver for the Apple Neural Engine ANE. All things Linux here. ane/: Kernel module ane.ko. Should move into tree soon. docs/: Documentation. WIP. Please don't look. libane/: Userspace lib. python/: Python bindings for libane...

Copy-Fail

CVE-2026-31431 "Copy Fail" - Local Privilege Escalation Python 3.7+ compatible version including Astra Linux Safe check without exploitation: curl -s https://raw.githubusercontent.com/p401a-ops/Copy-Fail/refs/heads/main/detect.py | python3 Exploitation when prompted, you will need to enter the us...

cve-2019-11477-poc

cve-2019-11477-poc Simple Test 1. Start two VMs one for an SSL server and the other for an SSL client 2. Server Execute the server application cd apps ./server.sh 7000 3. Client Install the required packages sudo apt-get install libmnl-dev sudo apt-get install libnetfilter-queue-dev 4. Client Add...