Alternatives and similar repositories for rootkit:

Users that are interested in rootkit are comparing it to the libraries listed below

• croemheld / lkm-rootkit
  A LKM rootkit for most newer kernel versions.
  ☆173Updated 7 years ago
• milabs / kmatryoshka
  Matryoshka - stacked LKM loader
  ☆50Updated last year
• tsarpaul / GLORYHook
  The first Linux hooking framework to allow merging two binary files into one!
  ☆94Updated 4 years ago
• W3ndige / linux-process-injection
  Proof of concept for injecting simple shellcode via ptrace into a running process.
  ☆69Updated 2 years ago
• Plazmaz / CVE-2019-18634
  A functional exploit for CVE-2019-18634, a BSS overflow in sudo's pwfeedback feature that allows for for privesc
  ☆58Updated 5 years ago
• RITRedteam / goofkit
  In line function hooking LKM rootkit
  ☆51Updated 5 years ago
• therealdreg / enyelkm
  LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.
  ☆86Updated last year
• dsnezhkov / zombieant
  Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.
  ☆225Updated 5 years ago
• mandiant / flare-kscldr
  FLARE Kernel Shellcode Loader
  ☆176Updated 5 years ago
• 86hh / POC-viruses
  POC viruses I have created to demo some ideas
  ☆59Updated 4 years ago
• makomk / aeskeyfind
  Fork of aeskeyfind that knows more formats of AES key schedule
  ☆64Updated 7 years ago
• Andromeda1957 / Reversing-Challenges
  Reverse engineering challenges
  ☆50Updated 5 years ago
• h0mbre / busychild
  a pstree mod that prints other helpful information and with added functionality
  ☆24Updated 4 years ago
• elfmaster / dt_infect
  ELF Shared library injector using DT_NEEDED precedence infection. Acts as a permanent LD_PRELOAD
  ☆110Updated 4 years ago
• xpn / ssh-inject
  A ptrace POC by hooking SSH to reveal provided passwords
  ☆181Updated 7 years ago
• d3npa / freebsd-rootkits
  Exercises from Designing BSD Rootkits working in 2020 with FreeBSD 12.2
  ☆47Updated 2 years ago
• PinkP4nther / Sutekh
  An example rootkit that gives a userland process root permissions
  ☆77Updated 5 years ago
• Error996 / bdvl
  bdvl
  ☆113Updated 3 years ago
• infosecguerrilla / ReflectiveSOInjection
  Reflective SO injection is a library injection technique in which the concept of reflective programming is employed to perform the loadin…
  ☆117Updated 8 years ago
• maK- / reverse-shell-access-kernel-module
  This is a kernel module invoked reverse shell proof of concept.
  ☆72Updated 5 years ago
• yrp604 / atc-sources
  Attacking the Core associated source files
  ☆88Updated 7 years ago
• intezer / MoP
  MoP - "Master of Puppets" - Advanced malware tracking framework
  ☆80Updated 6 months ago
• EgeBalci / Cminer
  Cminer is a tool for enumerating the code caves in PE files.
  ☆148Updated last year
• Bw3ll / JOP_ROCKET
  This framework enables user to discover JOP gagdets and can automate building a complete JOP chain to bypass DEP. JOP ROCKET is the ultim…
  ☆103Updated 7 months ago
• naivenom / exploiting
  Exploiting challenges in Linux and Windows
  ☆122Updated 5 years ago
• redtimmy / golden-frieza
  ELF launcher for encrypted binaries decrypted on-the-fly and executed in memory
  ☆26Updated 5 years ago
• chokepoint / Jynx2
  JynxKit2 is an LD_PRELOAD userland rootkit based on the original JynxKit. The backdoor has been replaced with an "accept()" system hook.
  ☆169Updated 12 years ago
• nnedkov / swiss_army_rootkit
  ☆33Updated 9 years ago
• hacksysteam / WpadEscape
  Sandbox escape using WinHTTP Web Proxy Auto-Discovery Service
  ☆85Updated 5 years ago
• milabs / lkrg-bypass
  LKRG bypass methods
  ☆71Updated 5 years ago