Awesome

libpreload

simple 'LD_PRELOAD' linux and osx rootkit examples. should be able to steal su and ssh passwords