Userland Rootkits Are Lame

• jemalloc

  42 9,602 8.7 C

  

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• libremotec

  2 7 10.0 C

• LD_PRELOAD-rand-Hijack-Example

  1 11 - C

  Code samples to go along with the blog post on using LD_PRELOAD to hijack rand() in a number guessing game.

  

• LD_PRELOAD-rand-Hijack

  1 - -

• asminject

  3 114 10.0 Python

  Heavily-modified fork of David Buchanan's dlinject project. Injects arbitrary assembly (or precompiled binary) payloads directly into x86-64, x86, and ARM32 Linux processes without the use of ptrace by accessing /proc/<pid>/mem. Useful for certain post-exploitation scenarios, recovering content from process memory, etc..

  

  If you have root access, you may be able to re-enable ptracing:

  https://github.com/BishopFox/asminject/tree/main/ptrace_scop...

  That specific technique only works if root can still load kernel modules, but if I could throw that together with minimal knowledge of the Linux kernel's inner workings, there's probably a sneakier way.

Suggest a related project