2018-06-30 09:13:25 +00:00
|
|
|
# `awesome-linux-rootkits`
|
|
|
|
|
2018-06-30 09:48:34 +00:00
|
|
|
## :key: feature table
|
2018-06-30 09:13:25 +00:00
|
|
|
|
2018-06-30 19:01:40 +00:00
|
|
|
Environment:
|
2018-06-30 21:16:57 +00:00
|
|
|
- CPU architecture
|
2018-06-30 19:01:40 +00:00
|
|
|
- Kernel/User mode (or mixed)
|
|
|
|
|
|
|
|
Core capabilities:
|
|
|
|
- Persistency
|
2018-06-30 19:20:34 +00:00
|
|
|
- Management interface
|
2018-06-30 19:14:49 +00:00
|
|
|
|
|
|
|
Stealth capabilities:
|
2018-06-30 19:24:42 +00:00
|
|
|
- Detection evasion
|
2018-06-30 19:14:49 +00:00
|
|
|
- System logs cleaning (filtering)
|
2018-06-30 19:01:40 +00:00
|
|
|
|
|
|
|
Hiding stuff capabilities:
|
|
|
|
- Hiding of files and directories
|
|
|
|
- Hiding of processes and process trees
|
|
|
|
- Hiding of network connections and activity
|
|
|
|
- Hiding of process accounting information (like CPU usage)
|
|
|
|
|
|
|
|
Additional functions:
|
|
|
|
- Keylogger
|
|
|
|
- Backdoor/shell
|
2018-06-30 09:16:23 +00:00
|
|
|
|
2018-06-30 21:18:03 +00:00
|
|
|
## :see_no_evil: user mode rootkits
|
2018-06-30 09:16:23 +00:00
|
|
|
|
|
|
|
- https://github.com/mempodippy/vlany
|
|
|
|
|
|
|
|
Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
|
2018-06-30 09:46:39 +00:00
|
|
|
|
2018-06-30 21:44:19 +00:00
|
|
|
- https://github.com/unix-thrust/beurk
|
|
|
|
|
|
|
|
BEURK is an userland preload rootkit for GNU/Linux, heavily focused around anti-debugging and anti-detection.
|
|
|
|
|
2018-06-30 21:49:30 +00:00
|
|
|
- https://github.com/chokepoint/azazel
|
|
|
|
|
|
|
|
Azazel is a userland rootkit based off of the original LD_PRELOAD technique from Jynx rootkit.
|
|
|
|
|
2018-06-30 21:57:27 +00:00
|
|
|
- https://github.com/chokepoint/Jynx2
|
|
|
|
|
|
|
|
JynxKit2 is an LD_PRELOAD userland rootkit based on the original JynxKit.
|
2018-06-30 22:06:45 +00:00
|
|
|
|
|
|
|
- https://github.com/NexusBots/Umbreon-Rootkit
|
|
|
|
|
|
|
|
LD_PRELOAD based
|
2018-06-30 21:57:27 +00:00
|
|
|
|
2018-06-30 21:18:03 +00:00
|
|
|
## :hear_no_evil: kernel mode rootkits
|
2018-06-30 09:46:39 +00:00
|
|
|
|
|
|
|
- https://github.com/f0rb1dd3n/Reptile
|
|
|
|
|
|
|
|
Reptile is a LKM rootkit written for evil purposes that runs on Linux kernel 2.6.x/3.x/4.x
|
2018-06-30 21:12:39 +00:00
|
|
|
|
2018-06-30 10:09:49 +00:00
|
|
|
- https://github.com/QuokkaLight/rkduck
|
|
|
|
|
|
|
|
rkduck - Rootkit for Linux v4
|
2018-06-30 13:26:13 +00:00
|
|
|
|
2018-06-30 21:16:57 +00:00
|
|
|
- https://github.com/mncoppola/suterusu
|
|
|
|
|
2018-06-30 21:27:30 +00:00
|
|
|
An LKM rootkit targeting Linux 2.6.x/3.x on x86, and ARM
|
2018-06-30 21:37:59 +00:00
|
|
|
|
|
|
|
- https://github.com/nurupo/rootkit
|
|
|
|
|
|
|
|
Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64
|
2018-06-30 21:16:57 +00:00
|
|
|
|
2018-06-30 21:18:03 +00:00
|
|
|
- https://github.com/m0nad/Diamorphine :shit:
|
2018-06-30 21:12:39 +00:00
|
|
|
|
|
|
|
LKM rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64)
|
2018-06-30 21:32:07 +00:00
|
|
|
|
|
|
|
- https://github.com/ivyl/rootkit :shit:
|
|
|
|
|
|
|
|
Sample Rootkit for Linux
|
2018-06-30 21:50:42 +00:00
|
|
|
|
|
|
|
- https://github.com/Eterna1/puszek-rootkit
|
|
|
|
|
|
|
|
Yet another LKM rootkit for Linux. It hooks syscall table.
|
|
|
|
|
2018-06-30 21:57:27 +00:00
|
|
|
- https://github.com/trimpsyw/adore-ng
|
|
|
|
|
|
|
|
linux rootkit adapted for 2.6 and 3.x
|
|
|
|
|
|
|
|
- https://github.com/bones-codes/the_colonel
|
|
|
|
|
|
|
|
An experimental linux kernel module (rootkit) with a keylogger and built-in IRC bot
|
2018-06-30 22:01:05 +00:00
|
|
|
|
|
|
|
- https://github.com/David-Reguera-Garcia-Dreg/enyelkm
|
|
|
|
|
|
|
|
LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.
|
2018-06-30 22:03:53 +00:00
|
|
|
|
|
|
|
- https://github.com/falk3n/subversive
|
|
|
|
|
|
|
|
x86_64 linux rootkit using debug registers
|
2018-06-30 22:04:47 +00:00
|
|
|
|
|
|
|
- https://github.com/jiayy/lkm-rootkit
|
|
|
|
|
|
|
|
An lkm rootkit support x86/64,arm,mips
|