eBPF-based Security Observability and Runtime Enforcement

🎧 mpris media player command-line controller for vlc, mpv, RhythmBox, web browsers, cmus, mpd, spotify and others.

Userspace Raspberry Pi PWM library for WS281X LEDs

Simple shell implementation. Tutorial here ->

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.

ebpfkit is a rootkit powered by eBPF

IPA sideloader based on AltServer

chw00t - Unices chroot breaking tool

exploit for CVE-2022-2588

NetworkManager VPN Plugin: Wireguard

CVE-2022-0185

Linux Kernel Runtime Integrity with eBPF

A simple LD_PRELOAD library to disable SSL certificate verification. Inspired by libeatmydata.

A stealthy ELF loader - no files, no execve, no RWX

Durandal's Backdoor

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

A container image that exfiltrates the underlying container runtime to a remote server

An intentionally vulnerable linux driver for research purposes/practice in kernel exploit dev

Linux kernel source tree with OpenPaX patch

Example of passing file descriptors into a container to perform a privilege escalation on the host

Tool for computing WWW-Digest MD5 HA1 string

Encrypted Netcat (formerly Shadowinteger’s [sbd] then Durandal's [dbd] Backdoor) it uses crypto from tsh