Top 7 C++ rootkit Projects

Nidhogg

9 1,597 8.3 C++

Nidhogg is an all-in-one simple to use rootkit.

Project mention: Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. | /r/netsec | 2023-06-24

This is not an exploit nor an example about how to write a driver and I didn't write anywhere about an exploit or how to write an driver. If you are looking for these kind of resources, feel free to check out my driver programming blog series "Lord of the Ring0" (and a talk that will be released soon! :) ): https://idov31.github.io/2022/07/14/lord-of-the-ring0-p1.html

Cronos-Rootkit

2 793 1.8 C++

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.
InfluxDB

www.influxdata.com sponsored

Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.
Chaos-Rootkit

1 683 7.6 C++

Now You See Me, Now You Don't
Black-Angel-Rootkit

2 565 4.4 C++

Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.
Jormungandr

5 208 4.5 C++

Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. (by Idov31)

Project mention: Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. | /r/RedSec | 2023-06-27

Kernel-Process-Hollowing

1 175 5.2 C++

Windows x64 kernel mode rootkit process hollowing POC.

Project mention: Kernel-Process-Hollowing: Windows x64 kernel mode rootkit process hollowing POC. | /r/blueteamsec | 2023-06-29

NtSymbol

1 94 0.0 C++

Resolve DOS MZ executable symbols at runtime
WorkOS

workos.com sponsored

The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020).