reveng007 / reveng_rtkitLinks
Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.
☆262Updated last month
Alternatives and similar repositories for reveng_rtkit
Users that are interested in reveng_rtkit are comparing it to the libraries listed below
Sorting:
- Red-Team LKM☆627Updated 3 weeks ago
- Academic project of Linux rootkit made for Bachelor Engineering Thesis.☆117Updated last year
- Exploit Development - Weaponized Exploit and Proof of Concepts (PoC)☆235Updated 2 years ago
- Collection of codes focused on Linux rootkits☆192Updated 2 months ago
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆672Updated 3 years ago
- POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY☆226Updated 9 months ago
- LD_PRELOAD rootkit☆137Updated last year
- PoCs for Kernelmode rootkit techniques research.☆424Updated 2 months ago
- The source code files that accompany the short book "Building C2 Implants in C++: A Primer" by Steven Patterson (@shogun_lab).☆235Updated last year
- Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.☆580Updated 5 months ago
- ☆179Updated 2 years ago
- RunPE implementation with multiple evasive techniques (1)☆377Updated 2 years ago
- ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Sysc…☆164Updated last month
- Kernel Exploits☆259Updated 4 years ago
- ☆90Updated last year
- A Linux kernel rootkit in Rust using a custom made type-2 hypervisor, eBPF XDP and TC programs☆335Updated 6 months ago
- Native Syscalls Shellcode Injector☆267Updated 2 years ago
- APT38 Tactic PoC for Stealing 0days from security researchers☆325Updated 7 months ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆474Updated 6 months ago
- Proof of concept & details for CVE-2025-21298☆193Updated 11 months ago
- An automatic Blind ROP exploitation tool☆205Updated 2 years ago
- Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.☆648Updated 2 years ago
- My collection of malware dev links☆304Updated 7 months ago
- nysm is a stealth post-exploitation container.☆265Updated 6 months ago
- Vulnerable driver research tool, result and exploit PoCs☆225Updated 2 years ago
- Revenant - A 3rd party agent for Havoc that demonstrates evasion techniques in the context of a C2 framework☆388Updated last year
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆745Updated 5 months ago
- Bootkit sample for firmware attack☆265Updated last year
- Simple undetectable shellcode and code injector launcher example. Inspired by RTO malware development course.☆279Updated 3 months ago
- LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.☆319Updated last year