User Level Rootkit that injects into explorer.exe and loads any dll into explorer.exe making the code look like a trusted program.
Lightweight • Educational • Terminal Based
scriptus-kit is a Python-based user level rootkit but injects into explorer.exe to elevate permissions bypassing whitelisted maleware where the process is trusted like "convhost" or "explorer.exe"
It is intended for experimenting / learning.
- The scriptkit.dll is the
git clone https://github.com/yourname/scriptus-kit.git
cd scriptus-kit
pip install -r requirements.txtscriptus --processesscriptus --networkscriptus --snapshot[!] Designed for educational use only
[!] Do not use on systems without permission
[!] Avoid modifying system-critical processes
This project is intended for learning purposes only. Unauthorized use on systems you do not own or have permission to analyze may violate laws or policies.