MatheuZ

Singularity. Stealthy Linux Kernel Rootkit for modern kernels (6x)

D3m0n1z3dShell. Demonized Shell is an Advanced Tool for persistence in linux.

RingReaper. Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls.

Rootkit. Collection of codes focused on Linux rootkits

Koth-TryHackMe-Tricks. Koth - TryHackMe Tricks

ElfDoor-gcc. ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code.

ksentinel. Linux kernel integrity monitor for detecting syscall hooking

ModTracer. ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

detect-lkm-rootkit-cheatsheet. Cheat sheet to detect and remove linux kernel rootkit

systemd-backdoor. A simple script to automate systemd backdoor

NullSection. NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes.

Imperius. Make an Linux Kernel rootkit visible again.

UnhookingLinuxEdr. Attacking the cleanup_module function of a kernel module

Exploit-CVE-2025-24799. CVE-2025-24799 Exploit: GLPI - Unauthenticated SQL Injection

Infector. This is a simple process injection made in C for Linux systems

koth-protect-king. A script to protect your king in KoTH

KThreadShell. Persistent Reverse Shell with Kernel Thread Monitoring and Uninterruptible Sleep

Simple-BufferOverflow. A simple C program to demonstrate a Buffer Overflow.

RootKits-List-Download. This is the list of all rootkits found so far on github and other sites.

Simple-PortScanner. A simple port scanner made in python 3.

Taint. POC/Demo hiding taint message from /dev/kmsg and dmesg.

KillHook. A simple LKM that uses ftrace to hook sys_kill

matheuzsecurity.github.io. My blog

writeup-ctf-meninadecybersec.

awesome-linux-rootkits. awesome-linux-rootkits