windows kernel security development

Webshell && Backdoor Collection

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

This is the list of all rootkits found so far on github and other sites.

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64)

Windows driver with usermode interface which can hide objects of file-system and registry, protect processes and etc

Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

awesome-linux-rootkits

This tool will setting up your backdoor/rootkits when backdoor already setup it will be hidden your spesisifc process,unlimited your session in metasploit and transparent. Even when it killed, it will re-run again. There always be a procces which while run another process,So we can assume that this procces is unstopable like a Ghost in The Shell

Hypervisor Memory Introspection Core Library

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

LD_PRELOAD Linux rootkit (x86 & ARM)

PCI Express DIY hacking toolkit for Xilinx SP605

Your interpreter isn’t safe anymore  —  The PHP module backdoor

💣 just for fun ¯\_(ツ)_/¯

Shadow-Box: Lightweight and Practical Kernel Protector for x86 (Presented at BlackHat Asia 2017/2018, beVX 2018 and HITBSecConf 2017)

A rootkit for Android. Based on "Android platform based linux kernel rootkit" from Phrack Issue 68

Tool to generate a Linux kernel module for custom rules with Netfilter hooking. (block ports, Hidden mode, functions to protect etc)

www.rootkit.com users section mirror, sql database dump, and a few other files/rootkits.

a summary of linux rootkits published on GitHub

A LKM rootkit for most newer kernel versions.

Linux v4.x.x Rootkit

Shadow-Box: Lightweight and Practical Kernel Protector for ARM (Presented at BlackHat Asia 2018)

LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.

An example rootkit that gives a userland process root permissions

A practical tool for bytecode manipulation and creating Managed Code Rootkits (MCRs) in the Java Runtime Environment

Protects deletion of files with a specified extension using a kernel-mode driver.

Rootkit Detector for UNIX

Fend off malware at Qubes VM startup

Linux Rootkits (4.x Kernel)