A make an LKM rootkit visible again. It involves getting the memory address of a rootkit’s “show_module” function, for example, …
ModTracer – ModTracer Finds Hidden Linux Kernel Rootkits And Then Make Visible Again
ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again. Another way to make an LKM visible is using the imperius trick: https://github.com/MatheuZSecurity/Imperius …
VectorKernel – PoCs For Kernelmode Rootkit Techniques Research
PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support 64bit OS only. NOTE …
D3m0n1z3dShell – Demonized Shell Is An Advanced Tool For Persistence In Linux
Demonized Shell is an Advanced Tool for persistence in linux. Install git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.gitcd D3m0n1z3dShellchmod +x demonizedshell.shsudo ./demonizedshell.sh One-Liner Install …
VED-eBPF – Kernel Exploit And Rootkit Detection Using eBPF
VED (Vault Exploit Defense)-eBPF leverages eBPF (extended Berkeley Packet Filter) to implement runtime kernel security monitoring and exploit detection for …
DynastyPersist – A Linux Persistence Tool!
A Linux persistence tool! A powerful and versatile Linux persistence script designed for various security assessment and testing scenarios. This …
Hidden – Windows Driver With Usermode Interface Which Can Hide Processes, File-System And Registry Objects, Protect Processes And Etc
Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a …
R77-Rootkit – Fileless Ring 3 Rootkit With Installer And Persistence That Hides Processes, Files, Network Connections, Etc…
Ring 3 rootkit r77 is a ring 3 Rootkit that hides following entities from all processes: Files, directories, junctions, named …
Red-Detector – Scan Your EC2 Instance To Find Its Vulnerabilities Using Vuls.io
Scan your EC2 instance to find its vulnerabilities using Vuls (https://vuls.io/en/). Audit your EC2 instance to find security misconfigurations using …
WinPmem – The Multi-Platform Memory Acquisition Tool
The WinPmem memory acquisition driver and userspace WinPmem has been the default open source memory acquisition driver for windows for …