mirror of
https://github.com/milabs/awesome-linux-rootkits.git
synced 2024-09-21 05:35:43 +00:00
50 lines
1.1 KiB
Markdown
50 lines
1.1 KiB
Markdown
# `awesome-linux-rootkits`
|
|
|
|
## :key: feature table
|
|
|
|
Environment:
|
|
- CPU architecture
|
|
- Kernel/User mode (or mixed)
|
|
|
|
Core capabilities:
|
|
- Persistency
|
|
- Management interface
|
|
|
|
Stealth capabilities:
|
|
- Detection evasion
|
|
- System logs cleaning (filtering)
|
|
|
|
Hiding stuff capabilities:
|
|
- Hiding of files and directories
|
|
- Hiding of processes and process trees
|
|
- Hiding of network connections and activity
|
|
- Hiding of process accounting information (like CPU usage)
|
|
|
|
Additional functions:
|
|
- Keylogger
|
|
- Backdoor/shell
|
|
|
|
## :see_no_evil: user mode rootkits
|
|
|
|
- https://github.com/mempodippy/vlany
|
|
|
|
Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
|
|
|
|
## :hear_no_evil: kernel mode rootkits
|
|
|
|
- https://github.com/f0rb1dd3n/Reptile
|
|
|
|
Reptile is a LKM rootkit written for evil purposes that runs on Linux kernel 2.6.x/3.x/4.x
|
|
|
|
- https://github.com/QuokkaLight/rkduck
|
|
|
|
rkduck - Rootkit for Linux v4
|
|
|
|
- https://github.com/mncoppola/suterusu
|
|
|
|
An LKM rootkit targeting Linux 2.6.x/3.x on x86, and ARM
|
|
|
|
- https://github.com/m0nad/Diamorphine :shit:
|
|
|
|
LKM rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64)
|