The Linux Kernel Module Programming Guide (updated for 5.0+ kernels)

Linux Kernel Rootkit for modern kernels (6x)

LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.

An example rootkit that gives a userland process root permissions

A rootkit for Android.

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

Attacking the cleanup_module function of a kernel module

A quick LKM rootkit that executes a reverse TCP netcat shell with root privileges.

Cheat sheet to detect and remove linux kernel rootkit

Reverse shell and rootkit

Tools to bypass flawed SELinux policies using the init_module system call

Utility to find hidden Linux kernel modules

Virtual Linux block device driver for simulating and performing I/O.

64-bit LKM Rootkit builder based on yaml prescription. Working on 5.15.5 kernel

Ftrace Based Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x and 6.x on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation

A local LKM rootkit loader/dropper that lists available security mechanisms

Rust out-of-tree Linux Kernel Modules (LKMs) experimentation framework

Make an Linux Kernel rootkit visible again.

Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x and 6.x on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation