Kernel Pack
Kernel Pack
Kernel Pack is the game over tool that allows you to create your own rootkit (driver) and uses exploits to obtain ring-0 access. It enables you to design, build, deploy, and control kernel‑level rootkits through a full-featured graphical C2 interface.
Single‑user, single machine. Each license is watermarked and tied to the email used at purchase; one license per person, one machine per license.
Renewals: Special pricing is available for customers with an active license. Please contact support@exploitpack.com
Couldn't load pickup availability
The game-over tool with low-level access
Rootkit and kernel-level development have always been complex and challenging, but we've changed that and made it accessible, manageable, and efficient with our research and the development of Kernel Pack.
Kernel Pack is a ring-0 Kernel exploitation tool for Red Teams and Penetration Testers. It' s the only tool in the market that allows you to configure, interact, set up and deploy your own rootkit.
Get silent with kernel-level process hiding, disable event traces, bypass AMSI and Patchguard, escalate to PPL and conquer. To get to the real low-level, get Kernel Pack.
Do you need a quote? Contact us
Key Features
-
Kernel Callback & System Activity Visibility
Provides a kernel‑level view into registered callbacks from other drivers, including object callbacks and activity hooks for process/thread creation, image loading, and registry operations. It surfaces this visibility through a single callback action that lets you query, remove, or restore specific callback types, giving operators a focused way to inspect and manage kernel activity signals from one place.
-
Event Tracing for Windows (ETW)
Kernel Pack includes an ETW control that allows operators to toggle the Event Tracing for Windows Threat Intelligence (ETW-TI) provider on or off. The functionality is exposed via the etwti kernel command (enable/disable), which dispatches the request to the agent and executes the change in kernel context. This enables direct control over ETW-TI telemetry generation from the console.
-
Process Protection & Anti-Tampering
Provides kernel‑level controls to protect, elevate, hide, or restore specific process IDs (with a built‑in PatchGuard safety warning around hiding), and it pairs those controls with a DLL/PPL agent builder that packages a standard DLL implant or a PPL‑bypass variant with optional KnownDLL unhooking to harden or shield protected processes.
-
Persistence Capabilities
Kernel-assisted mechanisms designed to support durable agent continuity across reboots and system disruptions, particularly in environments where userland persistence is unreliable or heavily monitored. By operating at a lower system level, these capabilities offer improved resilience and reduced exposure to common detection methods compared to traditional autorun techniques. The functionality is delivered through structured operator workflows, allowing controlled deployment aligned with engagement needs and target stability.
-
Privilege Elevation & Process Signature Control (PP / PPL)
Privilege Elevation & Process Signature Control (PP / PPL) exposes elevation and signature actions through the kernel‑level process controls and provides a dedicated DLL/PPL implant builder for protected‑process scenarios. Operators can select, evate or signature for a target PID via the process command flow, while the PPL workflow packages a “DLL + PPL Bypass Implant” that includes the PPL injection component for protected process access; UAC elevation hooks in the agent wizards complement this by relaunching the agent in an elevated context when needed.
-
Callback Management & Event Interaction
Provides a focused kernel‑level control surface for inspecting and managing callback registrations including object callbacks and the process/thread creation, image load, and registry callback routines, while also offering a direct toggle for the ETW Threat Intelligence provider. These controls let operators query, remove, or restore callbacks and quickly enable or disable event visibility through a single, consistent command flow.
-
Credential Access & Injection Capabilities
Centralises sensitive post‑execution actions by offering a credential‑dump workflow that targets LSASS memory and by providing two injection paths: DLL injection and Shellcode injection, each configurable by target PID, payload path, and delivery method (APC or remote thread).
-
Dumping Credentials from LSASS
Designed to support advanced post-exploitation workflows where credential material is required.
The agent performs a kernel-level operation that targets the LSASS process memory and extracts 3DES keys associated with protected authentication data. This capability is very useful during Red Team engagements and provides a structured method for retrieving credential-related artifacts from secured system components.
Questions About This Product
What type of license is included?
All our tools are provided under an annual license.
Do licenses renew automatically?
No. Licenses are not automatically renewed. You may choose to renew each year at your own convenience.
How many users can use one license?
Each license is issued on a single-user basis. Sharing between multiple individuals is not permitted.
Integration with other tools
Kernel Pack is the final stage in the stack: When authorized and required, it extends post-exploitation capabilities to the kernel level for advanced testing scenarios. The “ultimate” controlled evaluation phase for red teams.
Can I use the license against multiple targets?
Yes. While some tools in the industry restrict you to a limited number of targets, our licenses allow you to use the tool against as many machines as needed within your authorised engagements.
Delivery of licenses
Licenses are delivered digitally to the email used at purchase. Since they are sent manually, delivery may take up to 24 hours (usually faster).
Once the order is confirmed and the license has been delivered, it cannot be transferred, and refunds will not be issued.