1959 matches found
HellHall
HellsHall - Another Way To Fetch Clean Syscalls HellsHall is a combination of HellsGate and indirect syscalls. How it works First, HellsHall checks whether the syscall address is hooked and tries to retrieve the syscall number by checking the presence of the following bytes: 0x4C, 0x8B, 0xD1, 0xB...
blackpill
BlackPill BlackPill is a stealthy Linux rootkit made in Rust. Features The rootkit is composed of multiple modules talking about Rust modules, not kernel modules: defense evasion : hide files, processes, network connections, etc. hooking : hook syscalls and IDT hypervisor : create a virtual machi...
CVE-2026-31431-Copy-Fail-add-arm64
Vulnerability Overview Item| Content ---|--- CVE ID| CVE-2026-31431 Vulnerability Name| Copy Fail Vulnerability Type| Linux Kernel Local Privilege Escalation LPE CVSS 3.1 Score| 7.8 HIGH CWE| CWE-669: Incorrect Resource Transfer Between Spheres Affected Scope| All Linux kernels built between 2017...
copyFail30
CopyFail for Python versions 3.10 Os did not contain splice before version 3.10. This version of copyFail uses ctypes to make the syscall between descriptors without a utilizing the splice wrapper. Works on both older and current versions of python3. Based on...
CVE-2026-31431-detection-defense
CVE-2026-31431: Detection & Defense Against iouring Bypass of Existing Detection Authors : fz0x00, qiwuSEC Research For CVE-2026-31431 "Copy Fail", we demonstrated systematic weaknesses in mainstream security products by combining three bypass strategies: iouring async I/O path , process splittin...
seccomp-tools
Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...
snoop
snoop A syscall tracer for Linux, built on eBPF. Like strace but with a live TUI, smart filters, and argument decoding you can actually read. $ sudo snoop curl https://example.com 0.001 curl1234/1234 openatATFDCWD, "/etc/ssl/certs/ca-certificates.crt", ORDONLY = 4 0.002 curl1234/1234 read4,...
project-rvbbit
Project RVBBIT: Linux Kernel Rootkit Proof-of-Concept 📖 Overview Project RVBBIT is an educational proof-of-concept demonstrating advanced stealth techniques used by Linux kernel rootkits. It is intended exclusively for cybersecurity research, defensive training, and understanding how modern...
ksentinel
ksentinel - Kernel Syscalls Integrity Monitor Overview ksentinel monitors critical kernel functions and the syscall table for unauthorized modifications. It detects common syscalls that are targeted by most rootkits including ftrace hooks, kprobes, and syscall table hijacking. Features Function...
CouchPotato
CouchPotato Make sure you compile on your own to avoid detection.. certain strings are XOR at compile time.. I will not be publishing anymore binaries. Usage: CouchPotato.exe ip port Patches ETW & AMSI and uses indirect syscall to abuse SeImpersonatePrivilege. Service account || Admin - NT system...
MalwareApiLibrary
MalwareApiLibrary : collection of apis used for malware development : StringManagementLib : manage strings, string hashes, and others WinApiManagementLib : replacement of GetModuleHandle and GetProcAddress functions SyscallsManagementLib : runs Hellsgate, TartarusGate, PerunsFart so far to unhook...
NimGetSyscallStub
NimGetSyscallStub Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs...
HallWatch
HallWatch Copyright C 2026 Adam Zypherion — licensed under GPL-3.0. Indirect syscalls are simple once you have seen one. The loader walks ntdll, reads the SSN out of Nt prologue, finds the 0F 05 two bytes further in, sets r10/rax/rdx/r8/r9 itself, and jmps straight at those two bytes. The syscall...
TinyProcessor
TinyProcessor This project replaces syscall numbers & arguments in Tinytracer's .tag output w/ their actual Nt function declarations for better readability. Do note that some functions declarations are not included, so some arguments will not be processed The function declarations I use in this...
linux-root-kit
About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...
ish
iSH A project to get a Linux shell running on iOS, using usermode x86 emulation and syscall translation. For the current status of the project, check the issues tab, and the commit logs. App Store page TestFlight beta Discord server Wiki with help and tutorials README中文 如若未能保持最新，请提交PR以更新 Hacking...
syscall_exploit_CVE-2018-8897
This repository does not have a README...
EDRs
EDRs This repo contains information about EDRs that can be useful during red team exercise. patchsyscalldynamically64.c This proof-of-concept is resolving the syscall ID dynamically no need to check the version running on the remote host. To get the information on disk not tampered a call to...
ptrace-vuln
ptrace-vuln To check for vulnerability CVE-2019-13272 It is just a sample proof of concept generated by LLM and does not cover all cases. The basic idea is if the system is not hardened and ptrace is not removed, the vulnerability should be considered applicable. Steps to compile code and run it:...