Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

A Linux kernel rootkit in Rust using a custom made type-2 hypervisor, eBPF XDP and TC programs

Academic project of Linux rootkit made for Bachelor Engineering Thesis.

In-Memory Rootkit For Linux and BSD

A rootkit for Android.

Ftrace Based Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x up to linux kernel 6.2 on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation - developed by Antonius in 2023 manually

Author of Project Adrishya a rootkit which use ftrace mechanism to hook syscall; (write this because God commanded me); work for both x86_64 and arm; CREDIT-(Oleksii Lozovskyi{ilammy})FOUNDER OF FTRACE HOOKING

Linux Rootkit (x86-64 / ARM64) that stealth hides processes, files, and sockets, hooks syscalls, encrypts traffic, and bypasses SELinux / AppArmor.

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)

Linux userland rootkit. Hides file and directory, hides process, hides bind shell port, hides daemon port, hides reverse shell port, cleans up bash history and logs during installation

Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x up to linux kernel 6.8 on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation

A userland rootkit

LD_PRELOAD rootkit that hooks raw syscalls with zpoline

PoC for a kernel rootkit

A malicious root kit made using c

HiddenGhost is an new solution for find system call table with support for 5.7x kernels +

this repository is purposed for learning about rootkit-development and kernel hacking

Linux Rootkit