nopn0p / rkorova

ld_preload userland rootkit

rkorova: LD_PRELOAD rootkit

This is an LD_PRELOAD rootkit I wrote several years ago in high school and have been trying sporadically to improve ever since.

Features

• Important strings are xor'ed out
• ptrace disabling
• Memory cleaning
• Process hiding (currently only through magic strings)
• File hiding through magic strings or GID
• Not detected by rkhunter (as of 2020)

Planned features

• Port hiding
• libpcap hooks
• Reverse shell
• Self-destruct feature
• VM detection (implemented a little bit)
• Better anti-debugging features
• Better code (never happening lol)
• C2 client
• Syscall hooking with ptrace

Requirements

• gcc
• libc6 (duh)
• nscd (this will totally break everything if it is not installed)