0xMrNiko / RootKitLinks
This repository contains Loadable Kernel Modules (LKM) and LD_PRELOAD-based modules designed for penetration testing, red teaming, and security research. These tools enable advanced techniques like process hiding, syscall hooking, and runtime application manipulation.
☆13Updated 11 months ago
Alternatives and similar repositories for RootKit
Users that are interested in RootKit are comparing it to the libraries listed below
Sorting:
- ☆60Updated 8 months ago
- Bypasses AMSI protection through remote memory patching and parsing technique.☆54Updated 8 months ago
- This repo contains PoCs for vulnerable Windows drivers.☆88Updated last month
- T-1 is a shellcode loader that leverages ML techniques to detect VM environments☆34Updated last year
- Collection of red team techniques.☆65Updated 8 months ago
- Attacking the cleanup_module function of a kernel module☆54Updated 6 months ago
- Alternative Read and Write primitives using Rtl* functions the unintended way.☆78Updated 4 months ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆137Updated 4 months ago
- A command and control framework.☆54Updated last year
- Early cascade injection PoC based on Outflanks blog post written in Rust☆67Updated 3 weeks ago
- a demo module for the kaine agent to execute and inject assembly modules☆42Updated last year
- Reports on Driver, LSASS and other security services mitigations☆33Updated 5 months ago
- Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH☆136Updated 4 months ago
- Linux Sleep Obfuscation☆107Updated 2 years ago
- A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.☆72Updated last year
- A collection of PoCs to do common things in unconventional ways☆122Updated 4 months ago
- 「⚔️」Ring 0 Rootkit for Linux Kernels x86/x86_64 5.x/6.x☆26Updated 9 months ago
- Demoting PPL anti-malware services to less than a guest user☆65Updated 11 months ago
- ☆108Updated last year
- Section-based payload obfuscation technique for x64☆64Updated last year
- Driver Reverse & Exploitation☆82Updated 4 months ago
- This project is an implant framework designed for long term persistent access to Windows machines.☆109Updated 2 years ago
- Dll injection through code page id modification in registry. Based on jonas lykk research☆17Updated 3 years ago
- Unhook Ntdll.dll, Go & C++.☆32Updated 8 months ago
- A 64 bit executable junk code engine for polymorphic malware.☆75Updated 7 months ago
- This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)☆51Updated last year
- Охотник (Hunter) is a simple Adversary Simulation tool developed for achieves stealth through API unhooking, direct and indirect syscalls…☆90Updated 8 months ago
- Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies☆49Updated 6 months ago
- A fucking real shellcode loader with a GUI. Work-in-Progress.☆81Updated 6 months ago
- Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …☆102Updated 9 months ago