MatheuZ

Red Team Operator, Offensive Security Researcher, and Pentester

Linux-focused offensive security research: evasion, rootkits, telemetry bypass, and post-exploitation write-ups.

Discord

Writing

• 2025-05-14 · 5 min
  Bypassing LD_PRELOAD Rootkits Is Easy

  Introduction In this post, I’m going to get into a really cool topic, which is how to bypass the hooks used by LD_PRELOAD rootkits, a technique that is effective against most, if not all, of them. LD_PRELOAD LD_PRELOAD is an environment variable used by dynamic linkers on Unix-like systems (such as /lib64/ld-linux-x86-64.so.2 on x86_64 Linux) to force specific shared libraries to be loaded before any others during program execution.

  Rootkit
• 2025-04-13 · 6 min
  ElfDoor-gcc

  Hijacking GCC with LD_PRELOAD Introduction If you’ve ever wondered how it’s possible to inject malicious code into binaries without touching the source code, and using only standard Linux tools, this article is for you. We’ll explore a very cool technique that intercepts the compilation process with LD_PRELOAD, modifying the commands executed and forcing the inclusion of a malicious library during linking. In the end, the compiled binary looks legitimate, but it is infected with embedded malicious code, ready to be executed at the right time.

  Rootkit
• 2024-12-26 · 2 min
  Detecting rootkits based on ftrace hooking.

  Hello! Welcome to this post! Well, I have a server that is focused on rootkit research, both for Linux and Windows, feel free to come and participate in our community. https://discord.gg/66N5ZQppU7 What is Ftrace? ftrace (Function tracing) is a kernel function tracer. It helps a lot with debugging the Linux kernel, tracing functions, events, and of course, you can use ftrace to do hooking, etc. Main Features: Function Tracing: Records kernel function calls, including order and execution time. Event Tracing: Monitors system events. Custom Filters: Focus on specific functions or events via configuration files. Support for dynamic tracers like kprobes and integration with tools like perf. On more current systems, tracing is enabled by default, but if not, simply set it:

  Rootkit
• 2024-11-26 · 6 min
  How detect a LD_PRELOAD rootkit and hide from ldd & /proc

  Hello! Welcome to this post! Well, I have a group that is focused on rootkit research, both for Linux and Windows, feel free to come and participate in our community. https://discord.gg/66N5ZQppU7 What is LD_PRELOAD Rootkit? Before we begin, we need to understand what an LD_PRELOAD rootkit is. Is a type of malware that uses the LD_PRELOAD environment variable to load malicious shared libraries. It intercepts and modifies functions, allowing you to hide files, processes and activities. So, an LD_PRELOAD rootkit runs in user space (ring3), because it does not interact directly with the kernel. Introduction A good point about LD_PRELOAD Rootkit is that, unlike LKM (Loadable Kernel Module), they are much more stable, compatible and are also easier to develop.

  Rootkit
• 2024-08-26 · 4 min
  A simple way to detect and remove LKM rootkit KoviD (Outdated)

  Hello everyone, welcome to this post where I will cover the easiest way on how to detect and remove LKM KoviD rootkit. But first of all, we need to understand how the KoviD works. What is KoviD? KoviD is a Linux kernel rootkit, containing several features that make it difficult to detect and remove, in my opinion KoviD is the best open source LKM rootkit today, you can see more about it on github.

  Rootkit