h3xduck/TripleCross
FreeA Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
FreeFree tier
About h3xduck/TripleCross
TripleCross is an open-source Linux eBPF rootkit designed for educational and academic purposes. It showcases offensive eBPF capabilities including library injection, execution hijacking, local privilege escalation, backdoor and C2 communication, persistence, and stealth. The rootkit consists of several modules and a client for remote control, allowing an attacker to establish shell-like connections and execute commands. It was developed as part of a Bachelor's Thesis at UC3M and is intended solely for research and learning.
Key Features
Library injection module to execute malicious code by writing at a process' virtual memory.
Execution hijacking module that modifies data passed to the kernel to execute malicious programs.
Local privilege escalation module for running malicious programs with root privileges.
Backdoor with C2 capabilities that can monitor the network and execute commands from a remote rootkit client.
Multiple activation triggers for stealthy actions.
Rootkit client for establishing 3 different types of shell-like connections to control the rootkit remotely.
Persistence module that ensures the rootkit remains installed with full privileges even after a reboot.
Stealth module that hides rootkit-related files and directories from the user.
Pros & Cons
Pros
- Comprehensive set of offensive eBPF modules in a single rootkit.
- Well-documented with a thesis and detailed source code structure.
- Open source, allowing full inspection and learning.
- Includes C2, persistence, and stealth capabilities typical of real-world rootkits.
Cons
- Strictly for educational/academic use; misuse may result in legal consequences.
- Requires root privileges to install and run.
- Likely detectable by modern security tools, not designed for evasion in production environments.
- Limited to Linux systems and requires eBPF support.
Best For
Security research and education on offensive eBPF capabilities.Penetration testing in controlled, authorized environments.Demonstrating rootkit techniques for academic study.Understanding eBPF-based rootkit design and architecture.
FAQ
What is TripleCross?
TripleCross is a Linux eBPF rootkit created for educational purposes as part of a Bachelor's Thesis at UC3M. It demonstrates offensive eBPF capabilities including backdoor, C2, library injection, execution hijacking, persistence, and stealth.
Is TripleCross legal to use?
The rootkit is provided for educational and academic purposes only. The authors are not responsible for misuse. Users should not violate the law and should only run it in authorized environments.
How does TripleCross achieve persistence?
It includes a persistence module that ensures the rootkit remains installed and maintains full privileges even after a reboot event.
What are the main modules of TripleCross?
TripleCross includes library injection, execution hijacking, local privilege escalation, backdoor with C2, persistence, and stealth modules.