Alternatives and similar repositories for Rootkit

Users that are interested in Rootkit are comparing it to the libraries listed below

• MatheuZSecurity / ElfDoor-gcc
  ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.
  ☆130Updated 9 months ago
• cocomelonc / bsprishtina-2024-maldev-workshop
  BSides Prishtina 2024 Malware Development and Persistence workshop
  ☆124Updated 3 weeks ago
• CyberSecurityUP / Offensive-Windows-Drivers-Development
  ☆164Updated 10 months ago
• MatheuZSecurity / detect-lkm-rootkit-cheatsheet
  Cheat sheet to detect and remove linux kernel rootkit
  ☆78Updated last year
• TheMalwareGuardian / Awesome-Bootkits-Rootkits-Development
  A curated compilation of extensive resources dedicated to bootkit and rootkit development.
  ☆175Updated 5 months ago
• MatheuZSecurity / RingReaper
  Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.
  ☆360Updated 4 months ago
• CX330Blake / Shellcode-IDE
  Shellcode IDE — makes developing and analyzing shellcode much more convenient.
  ☆111Updated 2 months ago
• ArtemBaranov / WindowsRootkitsGuide
  ☆72Updated 11 months ago
• eversinc33 / 1.6-C2
  Using the Counter Strike 1.6 RCON protocol as a C2 Channel.
  ☆88Updated 11 months ago
• ynwarcs / CVE-2025-21298
  Proof of concept & details for CVE-2025-21298
  ☆193Updated last year
• rad9800 / byor
  ☆162Updated 7 months ago
• cocomelonc / mdmz_book
  The result of research and investigation of malware development tricks, techniques, evasion, cryptography and linux malware
  ☆67Updated 2 months ago
• MatheuZSecurity / ModTracer
  ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.
  ☆86Updated 11 months ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆211Updated last year
• MrAle98 / CVE-2025-21333-POC
  POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY
  ☆226Updated 9 months ago
• winsecurity / MaleficentVM
  This is practice VM for malware development
  ☆178Updated 2 months ago
• monsieurPale / RSA-Backdoor
  Generate backdoored RSA keys using SETUP
  ☆228Updated last month
• NVISOsecurity / codasm
  Payload encoding utility to effectively lower payload entropy.
  ☆123Updated 9 months ago
• hackerhouse-opensource / OffensiveLua
  Offensive Lua.
  ☆221Updated 2 months ago
• pwnwithlove / C_revshell
  Basic reverse shell in C using socket() with complete explanation
  ☆68Updated 2 years ago
• Maldev-Academy / MaldevAcademyLdr.2
  RunPE implementation with multiple evasive techniques (2)
  ☆265Updated 4 months ago
• hackerhouse-opensource / Artillery
  CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administr…
  ☆182Updated 2 years ago
• FuzzySecurity / BHUSA-2023
  ☆105Updated last year
• xaitax / NTSleuth
  Comprehensive Windows Syscall Extraction & Analysis Framework
  ☆160Updated 4 months ago
• outflanknl / edr-internals
  Tools for analyzing EDR agents
  ☆276Updated last year
• ZeroMemoryEx / CVE-2025-26125
  ( 0day ) Local Privilege Escalation in IObit Malware Fighter
  ☆164Updated 9 months ago
• PwnAwan / EXP-401-OSEE
  A bunch of resources to prepare for the OSEE certification, Offensive Security's hardest course.
  ☆110Updated 3 years ago
• 0xHossam / KernelCallbackTable-Injection-PoC
  Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…
  ☆268Updated last year
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆236Updated last year
• voidvxvi / HellBunny
  Malleable shellcode loader written in C and Assembly utilizing direct or indirect syscalls for evading EDR hooks
  ☆136Updated last year