Alternatives and similar repositories for rootkit:

Users that are interested in rootkit are comparing it to the libraries listed below

• W3ndige / linux-process-injection
  Proof of concept for injecting simple shellcode via ptrace into a running process.
  ☆63Updated 2 years ago
• croemheld / lkm-rootkit
  A LKM rootkit for most newer kernel versions.
  ☆172Updated 7 years ago
• therealdreg / enyelkm
  LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.
  ☆83Updated last year
• xpn / ssh-inject
  A ptrace POC by hooking SSH to reveal provided passwords
  ☆180Updated 7 years ago
• milabs / kmatryoshka
  Matryoshka - stacked LKM loader
  ☆50Updated last year
• dsnezhkov / zombieant
  Zombie Ant Farm: Primitives and Offensive Tooling for Linux EDR evasion.
  ☆218Updated 5 years ago
• netspooky / reversi
  Generate very tiny reverse shell binaries for Linux~
  ☆75Updated 4 years ago
• maK- / reverse-shell-access-kernel-module
  This is a kernel module invoked reverse shell proof of concept.
  ☆72Updated 5 years ago
• Error996 / bdvl
  bdvl
  ☆111Updated 2 years ago
• chokepoint / Jynx2
  JynxKit2 is an LD_PRELOAD userland rootkit based on the original JynxKit. The backdoor has been replaced with an "accept()" system hook.
  ☆164Updated 12 years ago
• Andromeda1957 / Reversing-Challenges
  Reverse engineering challenges
  ☆50Updated 5 years ago
• Plazmaz / CVE-2019-18634
  A functional exploit for CVE-2019-18634, a BSS overflow in sudo's pwfeedback feature that allows for for privesc
  ☆58Updated 4 years ago
• tsarpaul / GLORYHook
  The first Linux hooking framework to allow merging two binary files into one!
  ☆94Updated 4 years ago
• v-p-b / avpwn
  List of real-world threats against endpoint protection software
  ☆212Updated last month
• h0mbre / busychild
  a pstree mod that prints other helpful information and with added functionality
  ☆24Updated 4 years ago
• x64dbg / mona
  Fork of mona.py with x64dbg support
  ☆99Updated 2 years ago
• sandflysecurity / sandfly-processdecloak
  Sandfly Linux Stealth Rootkit Decloaking Utility
  ☆95Updated last year
• saaramar / execve_exploit
  Hardcore corruption of my execve() vulnerability in WSL
  ☆214Updated 6 years ago
• hacksysteam / WpadEscape
  Sandbox escape using WinHTTP Web Proxy Auto-Discovery Service
  ☆84Updated 5 years ago
• compilepeace / EVIL_RABBIT
  -x-x-x- DO NOT RUN ON PRODUCTION MACHINE -x-x-x- LD_PRELOAD based user-land rootkit for Linux platform.
  ☆27Updated 4 years ago
• therealdreg / lsrootkit
  Rootkit Detector for UNIX
  ☆61Updated last year
• Binject / binjection
  Injects additional machine instructions into various binary formats.
  ☆275Updated 11 months ago
• ihack4falafel / Slink
  Alphanumeric Shellcode (x86) Encoder
  ☆75Updated 2 years ago
• nccgroup / thetick
  A simple embedded Linux backdoor.
  ☆195Updated 4 years ago
• b1ack0wl / DVRF
  The Damn Vulnerable Router Firmware Project
  ☆30Updated 6 years ago
• hc0d3r / tas
  A tiny framework for easily manipulate the tty and create fake binaries.
  ☆154Updated 4 years ago
• milabs / lkrg-bypass
  LKRG bypass methods
  ☆71Updated 5 years ago
• redtimmy / golden-frieza
  ELF launcher for encrypted binaries decrypted on-the-fly and executed in memory
  ☆26Updated 4 years ago
• MohitDabas / malwinx
  Just a normal flask web app to understand win32api with code snippets and references.
  ☆72Updated 5 years ago
• infosecguerrilla / ReflectiveSOInjection
  Reflective SO injection is a library injection technique in which the concept of reflective programming is employed to perform the loadin…
  ☆115Updated 8 years ago