I have now completed and released the rootkit I previously promised to develop.

Next is the deployment file; it has specific execution requirements, but its purpose is to allow you to easily control the rootkit without the hassle of manually launching it. However, for this to work, parts 2 through 6 must be compiled and converted into drivers.

Additionally, all vulnerable drivers must be placed in the drivers folder. This project—phoenix_root—is part of the massive nightfury project 💤.

Instructions:

Vulnerable drivers: RTCore64.sys AsrDrv.sys GLCKIO2.sys

After placing the vulnerable drivers into the drivers folder (located within the compiled driver directory derived from parts 2 through 6), you must compile phoenix_service.c and place the resulting executable file in the same root folder where the deployment file is located.

You may add a client if needed, and you can utilize a C2 (Command & Control) system of your choice.

The Telnet password for the remote control panel is nightfury_admin_2026.

SysPeek یه ابزار خط فرمان ویندوزی برای تحلیل امنیتی و شناسایی تهدیداته

✅ اسکن پروسس‌ها و DLLها با تأیید امضا
✅ شکار LOLBinها و LSASS dumping
✅ تشخیص ردپای باج‌افزار و persistence
✅ اتصالات شبکه به همراه پروسس‌ها
✅ Baseline & Diff برای مشاهده‌ی تغییرات
✅ نظارت لحظه‌ای روی پروسس‌ها و پوشه‌ها
✅ خروجی JSON، CSV و HTML
✅ Threat Score و نگاشت به MITRE ATT&CK

https://github.com/batmanpriv/SysPeek

SysPeek

A blue-team recon & threat-detection toolkit for Windows

SysPeek digs into what's actually running on a Windows host — processes, DLLs, drivers, persistence mechanisms, network connections — and instead of dumping raw data on you, it tells you why something deserves a second look. 🎯

Built for SOC analysts and incident responders who need to walk up to an unfamiliar box and answer "what's really going on here?" in minutes, not hours

Git: https://github.com/batmanpriv/SysPeek

به قول دوستمون با این اوضاع مملکت دیگه نیازی به کلاهبردار نیست ایران فول آپشنه

A new version of the Modbus fuzzer has been released under the new name "Volt Fuzzer"

Addition of several techniques for the Modbus protocol

Addition of the DNP3 protocol to the fuzzer

Automatic protocol detection for a smoother fuzzing process

Support for adding RTU functionality across Windows, Linux, and Android

Use of standard libraries to ensure ease of execution for users

This book is for rootkit development

if you want to develop a rootkit be sure to read it

it is very useful

Tired of ZIP and RAR? Meet maxzip \(^_^)/

It's got 5 compression engines (zstd, xz, brotli, lz4, deflate), picks the best one automatically, removes duplicate data, encrypts with AES-256, and fits in a single file with zero dependencies.

Oh and it actually tests before compressing — no more guessing by file extension.

Check it out: github.com/batmanpriv/maxzip

You should definitely give this tool a try it is truly better than many other tools labeled as compressors

A look at the features and structure of phoenix and how to compile and use it:

Part 1 (related to kernel and bypass):

1.1 UEFI Bootkit Load drivers from ESP before booting Windows

1.2 Disabling Secure Boot Changing UEFI variables to bypass Secure Boot

1.3 Disabling HVCI Patching BCD and Kernel to disable Hypervisor-protected Code Integrity

1.4 Disabling DSE Patching the CiValidateImageHeader and CiGetPolicy functions in the kernel

1.5 Patch Boot Manager Patching bootmgr to bypass Integrity Checks

1.6 Spoof Driver Signature Replacing the driver signature with a Microsoft test signature

1.7 Registering Boot Entry Persistence at the UEFI level by registering a new Boot Option

1.8 Kernel DSE/KPP Bypass Directly patching kernel functions to disable PatchGuard

Part 2 (token manipulation and privilege escalation):

2.1 Token Stealing via DKOM Copying the SYSTEM token to the current process via EPROCESS

2.2 Token Stealing Safe Copy token while preserving RefCount to prevent BSOD

2.3 Token Duplication Create duplicate token with NtDuplicateToken

2.4 Enable All Privileges Enable 15+ Privileges including SeDebug, SeTcb, SeLoadDriver

2.5 CreateProcessWithToken Run process with arbitrary token (e.g. SYSTEM)

2.6 30 Local PE Techniques including Unquoted Path, DLL Hijacking, Scheduled Task, WMI Event, Named Pipe, SAM Copy, LSASS Dump, AlwaysInstallElevated, Print Spooler, CVE-2024-26229, CVE-2025-7771, CVE-2024-30804, CVE-2024-35250 and ...

2.7 30 Domain PE Techniques including Golden Ticket, Silver Ticket, Diamond Ticket, Skeleton Key, AD CS ESC1-ESC8, DCShadow, DCSync, Pass-the-Hash, Pass-the-Ticket, NTLM Relay, LDAP Injection, GPP Decryption and...

Part 3 (hiding and dkom):

3.1 Hide Process Remove process from ActiveProcessLinks with dynamic offset

3.2 Hide Thread Remove thread from ETHREAD list with dynamic offset

3.3 Hide Driver Remove driver from PsLoadedModuleList

3.4 Hide File Hide files via File System Filter

3.5 Hide Registry Key Hide registry keys via Registry Callbacks

3.6 Hide Network Connection Hide network connections

3.7 Patch 70+ Syscalls Patch NtQuerySystemInformation, NtOpenProcess, NtReadVirtualMemory, NtCreateFile, NtCreateKey, NtEnumerateKey and more than 70 other functions

3.8 Patch PspCidTable Hide from Windows Handle Table

3.9 Hide From Csrss Hide from Client/Server Runtime Subsystem

3.10 Hide From Task Manager Hide from Task Manager via patch functions

Part 4 (evasion):

4.1 Remove EDR Callbacks Remove callbacks EDR from PspCreateProcessNotifyRoutine, PspCreateThreadNotifyRoutine, and PspLoadImageNotifyRoutine

4.2 Patch AMSI Patch AmsiScanBuffer and AmsiScanString in amsi.dll

4.3 Patch ETW Patch EtwEventWrite, EtwEventWriteFull, EtwEventWriteString, EtwEventWriteTransfer

4.4 Syscall Hooks Hook 70+ Syscalls for hiding and control

4.5 Call Stack Spoofing Spoof Call Stack with Vectored Exception Handler

4.6 Indirect Syscall Execute Syscall without going to ntdll.dll

4.7 Install VEH Install Vectored Exception Handler for Spoofing

4.8 Enable All Evasion Enable all Evasion techniques at once

And the main part of the story, Part 5 (phoenix execution):

5.1 Process Hollowing Execute Payload in a legitimate process by unmapping the main part

5.2 APC Injection Inject and execute code via Asynchronous Procedure Call

5.3 Process Ghosting Execute code from a file that was deleted before execution

5.4 Atom Bombing Execute code via Atom Table

5.5 CreateRemoteThread Execute code in another process via CreateRemoteThread

5.6 QueueUserAPC Execute code via QueueUserAPC

5.7 Shellcode Execution Execute Shellcode directly in memory

5.8 CLR Hosting Execute .NET code via ICLRRuntimeHost

5.9 PowerShell Memory Execute PowerShell from memory without a file

5.10 WMI Execution Execute code via WMI

5.11 64 execution methods including Rundll32, Regsvr32, Msiexec, Cscript, Wscript, BitsAdmin, Certutil, Csc, InstallUtil, Regasm, Regsvcs, Msbuild, Vbc, Csc.exe, Jsc, Cmd, Wmic and more than 40 other methods

5.12 Auto Execute Automatically select the best execution method based on success statistics

5.13 Execute Elevated Execute Payload with SYSTEM token

5.14 Execute Remote Execute Payload in another process

Part 6 (persistence and communication):

6.1 Registry Run Persistence via Run Key in the registry

6.2 Scheduled Task Persistence via Scheduled Task

6.3 WMI Event Persistence via WMI Event Subscription

6.4 Windows Service Persistence via Windows Service Installation

6.5 Bootkit MBR Persistence in Master Boot Record

6.6 UEFI Boot Persistence in UEFI Boot Manager

6.7 ACPI Table Code injection into ACPI Tables

6.8 Hypervisor Persistence Persistence via Hypervisor

6.9 Kernel Callback Register Callback to re-execute the driver

6.10 AppInit_DLLs Load DLL in Per Process

6.11 AppCertDLLs Load DLLs into specific processes

6.12 COM Object Register COM Object for automatic execution

6.13 Winlogon Notify Run at login via Winlogon

6.14 SSH Keys Install SSH key for persistent access

6.15 NCrypt Keys Persistence via NCrypt

6.16 DNS Cache Poisoning DNS cache

6.17 Hosts File Modify hosts file for redirection

6.18 PowerShell Profile Run when PowerShell opens

6.19 AutoRun USB Run when USB is connected

6.20 Network Persistence Persistence via Port Proxy

6.21 Registry Policy Change registry policies

6.22 Startup Folder Copy file to Startup Folder

6.23 Image File Execution Debugger for automatic execution

6.24 DLL Hijack Hijacking system DLLs

6.25 Named Pipe Communication Communication via Named Pipe

6.26 Shared Memory Communication via shared memory Common

6.27 Logging Logging to C:\ProgramData\Phoenix.log

6.28 Install All Persistence Install all 26 persistence methods at once

6.29 Remove All Persistence Remove all persistence methods at once

The next project will likely be a backdoor complementing Phoenix Root or spyware capable of running on both Linux and Windows

After that project I will definitely work on industrial malware