reveng007 / reveng_rtkit

Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.

Home Page:https://reveng007.github.io/blog/2022/03/08/reveng_rkit_detailed.html

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Surviving system reboot

reveng007 opened this issue · comments

Goal:
Once our reveng_rtkit is loaded into the kernel, it should be impossible for defenders/admins to remove our LKM rootkit even after system reboot.