# krisnova/boopkit

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.

Repository: https://github.com/krisnova/boopkit
Canonical: https://ross.abutalabs.com/products/boopkit
Language: C
License: Apache-2.0
License Family: permissive
Topics: tcp, linux-kernel-hacking, ebpf, security
Last push: 2023-10-19T07:43:18+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 1617, "days_push": 1049, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1677, forks 183 (observed 2026-08-28T04:05:20.907460+00:00)

## What it is
boopkit is a Linux rootkit and backdoor written in C that uses eBPF to enable remote command execution over raw TCP. It requires prior privileged access on the target server and includes a client tool (boopkit-boop) for triggering reverse shells and RCE.

## Use cases
- demonstrate eBPF-based backdoor techniques in security research
- test detection capabilities against eBPF rootkits
- spawn a reverse shell over TCP on a server you already control
- study Linux kernel eBPF process hiding and obfuscation
- red team lab exercises for privileged post-exploitation

## When to choose
- you are a security researcher studying eBPF-based rootkits on Linux
- you need a lab tool to test endpoint detection of eBPF backdoors
- you want to demonstrate risks of eBPF abuse in privileged environments

## When to avoid
- you need a legitimate remote access tool like SSH for operations
- you lack prior privileged access on the target system
- you cannot accept the legal and operational risks of running rootkit software
- your environment is production and not an authorized testing lab

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, networking
- domain: security, penetration-testing, operating-systems
- platform: cli
- tags: ebpf, rootkit, backdoor, reverse-shell, tcp, red-team, security-research, linux

## Member repositories
- krisnova/boopkit (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:20.907460+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:41:36.590887+00:00, confidence not recorded.
  - readme: https://github.com/krisnova/boopkit (fetched 2026-08-28T04:05:20.907460+00:00, sha 1ccd5d4f22cd)
- Data as of 2026-08-30T08:39:29.467469+00:00.