awesome-linux-rootkits

🔑 feature table

• Operational environment (OE-*)
• Hiding of files and directories (HIDE-fs-*)
• Hiding of processes and process trees (HIDE-proc-*)
• Hiding of network connections and activity (HIDE-net-*)
• Keylogger (X-keylogger)

🙈 user mode rootkits 💩

• https://github.com/mempodippy/vlany

  Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

  ☝️ OE-user

🙉 kernel mode rootkits ❤️

• https://github.com/f0rb1dd3n/Reptile

  Reptile is a LKM rootkit written for evil purposes that runs on Linux kernel 2.6.x/3.x/4.x

  ☝️ OE-kernel HIDE-fs-{getdents,getdents64}

• https://github.com/QuokkaLight/rkduck

  rkduck - Rootkit for Linux v4

  ☝️ OE-kernel X-keylogger HIDE-fs-{filldir}