Live cryptojacking toolkit with CVE-2026-31431 LPE exploit, container escape, kernel rootkit, and XMRig Monero miner, captured from real attacks for defensive research and detection engineering.
A Linux Docker-to-host cryptojacking toolkit captured from live attacks on Kinryū Labs honeypots. It breaks in through an exposed Docker Engine API, escapes the container to root the host with CVE-2026-31431, installs a kernel rootkit, and runs an XMRig Monero miner.
Full technical analysis: https://kinryu.sh/reports/rootpacket-linux-cryptojacking-rootkit
TLP:CLEAR
⚠️ This repository contains live malware
Every file here is functional, hostile code, including a working privilege-escalation exploit. Handle it only inside an isolated, disposable VM with no real network access and a snapshot to roll back to. Never on a host, production system, or network you care about. You assume all risk.
If you run Linux, patch CVE-2026-31431 first (kernel 6.18.22 / 6.19.12 / 7.0+, or your distro's backport) before going near
getroot.
| File | What it is |
|---|---|
setup.sh | Installer / orchestrator. Picks root vs userland mode and lays down persistence. |
getroot | ⚠️ Working LPE exploit for CVE-2026-31431 ("Copy Fail"): an AF_ALG page-cache write that patches /usr/bin/su in memory. Also escapes containers to the host. |
xrandom | XMRig-based Monero miner, UPX-packed, renamed to blend in. |
killservice.sh | Competitor eviction + host hardening: kills rival miners, then closes the exposed services (including Docker 2375) it came in through. |
kernel/ | stealth.c LKM rootkit (disguised as intel_uncore_freq_aux) and its DKMS installer. Hides processes and fakes /proc/stat + /proc/meminfo. |
rootpacket.tar.gz | The packaged toolkit, as delivered from the payload host. |
| File | SHA-256 |
|---|---|
getroot | dda96d8a4bcc39dc7679347a4386bf1024152d2ccc46d333725ad0cda855d952 |
xrandom | ec3ef3dce99fa6cbc480f0f0b0c292676afed68704c44396271c7dc6afea2937 |
rootpacket.tar.gz: MD5 aa09915de9ce9dba8b62995e17fe9b97, 5,243,465 bytes.
-v /:/host --pid host) → chroot /host → pulls and runs this toolkit.getroot exploits CVE-2026-31431, a deterministic 4-byte page-cache write in the AF_ALG algif_aead interface (authencesn(hmac(sha256),cbc(aes))), to patch /usr/bin/su in memory and run shellcode as root. The on-disk file is never touched, so file-integrity monitoring sees nothing. Because the page cache is host-global, the same bug escapes an unprivileged container to the host./proc, so top shows a calm box.killservice.sh evicts rival miners and locks down other exposed services.Affected kernels: Linux 4.14 to 6.19.11. Fixed in 6.18.22 / 6.19.12 / 7.0+.
For defensive research, detection engineering, and education only. Do not use these samples, the exploit, or the techniques against systems you do not own or are not explicitly authorised to test. You are responsible for complying with the law in your jurisdiction (CFAA, Computer Misuse Act, and equivalents).
These samples were authored by third-party threat actors and are reproduced unmodified for analysis.
Corrections, sample requests, or takedown: [email protected] · kinryu.sh
rootpacket.tar.gze2d0dab6b29df89d123fe8581047a03ac9b89ae8fa0d1f334b5aefbb93152857 |