mempodippy/vlany
FreeLinux LD_PRELOAD rootkit (x86 and x86_64 architectures)
FreeFree tier
About mempodippy/vlany
vlany is a Linux LD_PRELOAD rootkit designed for x86 and x86_64 architectures. It provides extensive anti-detection capabilities, including process, user, and network hiding, along with anti-debug and anti-forensics features. The rootkit supports persistent (re)installation and multiple backdoor mechanisms such as an accept() backdoor (derived from Jynx2), a PAM backdoor, a PAM auth logger, and a snodew reverse shell backdoor. It also includes dynamic linker modifications and vlany-exclusive commands. Note: vlany is no longer maintained; users are directed to bdvl for continued updates. Installation is automated via a quick install script or a manual process with a TUI/CLI installer.
Key Features
Process hiding
User hiding
Network hiding
LXC container support
Anti-Forensics
Persistent (re)installation
Anti-Detection
Dynamic linker modifications
accept() backdoor (derived from Jynx2)
PAM backdoor
Pros & Cons
Pros
- Comprehensive anti-detection and anti-forensics features
- Multiple backdoor types (accept(), PAM, reverse shell)
- Persistent (re)installation for long-term access
- Automated installation script simplifies deployment
- Open source with GPL-3.0 license
Cons
- No longer maintained; superseded by bdvl
- Experimental and may cause system brick on reboot in some cases
- Fails to install correctly on systems above CentOS 6.6
- Lacks active development or bug fixes
Best For
Security research and penetration testingPost-exploitation persistence on Linux systemsRed team operations requiring stealthy rootkit capabilities
FAQ
What is vlany?
vlany is a Linux LD_PRELOAD rootkit for x86 and x86_64 architectures, providing process/network hiding, backdoors, anti-forensics, and anti-debug features.
Is vlany still maintained?
No, vlany is no longer maintained. Users are directed to bdvl (https://github.com/naworkcaj/bdvl) for constant updates.
What backdoors does vlany include?
vlany includes an accept() backdoor (derived from Jynx2), a PAM backdoor, a PAM auth logger, and a snodew reverse shell backdoor.