TripleCross

TripleCross is a Linux eBPF rootkit designed to illustrate the offensive capabilities of eBPF technology, developed as part of an academic thesis. Its primary use case involves demonstrating various malicious functionalities including library injection, execution hijacking, local privilege escalation, and stealth operations, all while maintaining a backdoor with command-and-control capabilities. Notable features include persistence across reboots and multiple methods for remote command execution, showcasing advanced techniques for evasion and control.