buter-chkalova/rvbbit-arsenal
GitHub: buter-chkalova/rvbbit-arsenal
该项目提供一套Linux内核攻防对偶的完整解决方案，通过攻击侧Rootkit与防御侧检测清除的对照，解决现代Linux环境下的高级威胁研究问题。
Stars: 16 | Forks: 7
# RVBBIT Arsenal：终极攻防双刃剑
## 概述
本仓库包含了一枚硬币的两面：
- **`attack/`** – Project RVBBIT，一个经典的 Linux kernel rootkit，内置 miner 和网络蠕虫。
- **`defense/`** – RvbbitSafe，能够检测、中和并清除 RVBBIT 所有痕迹的终极防御对策。
它们共同构成了关于现代 Linux rootkit 攻防的综合性教育资源。
## 快速开始
### 构建梦魇（攻击）
```
cd attack
First, embed the XMRig payload (see attack/README.md)
./build.sh
Deploy rvbbit_installer on isolated test VM
Note: Detailed instructions on embedding payloads are in attack/README.md.
Deploy the Cure (Defense)
bash
cd defense
chmod +x install.sh
sudo ./install.sh
Documentation
Full technical whitepaper available in docs/whitepaper.md.
Disclaimer
This software is provided for authorized educational and defensive research only. Misuse is strictly prohibited and may violate computer crime laws. The authors assume no liability for improper use.
## 局限性
This is a learning prototype. It uses dated techniques, generates detectable telemetry, and will not evade modern EDRs or hypervisor integrity checks. Not intended for operational use.
```
标签：0day挖掘, Linux, pdftotext, Rootkit, TLS, Zeek, 内核安全, 客户端加密, 恶意软件研究, 红蓝对抗, 防御工具