Linux Targets
Linux Targets
PayloadFactory can target Linux by passing --os linux (alias --target linux). This switches the stub templates, the compiler, and the valid technique set.
python main.py --os linux ptrace_inject -s sc.bin --process bash -o linux_payload
What changes for Linux
| Aspect | Windows | Linux |
|---|---|---|
| Compiler | x86_64-w64-mingw32-g++ / -clang++ | g++ / clang++ |
| Syscall layer | SysPlant generation, name randomization | Skipped — native libc syscalls |
| PPID spoofing | Available (--no-ppid-spoof to disable) | Not applied |
| DLL output | Supported (--dll, --dll-proxy) | Compiled with -shared -fPIC |
| OLLVM | Available via --clang | clang++ (standard) |
| Evasion | Hooks, sandbox checks, env keying | Not available (Windows-only) |
The Windows-only --syscall, -r/--recovery, and PPID-spoofing flags have no effect on Linux targets — generate_syscalls() is a no-op and the PPID attribute block is not emitted.
Linux injection techniques
The factory validates the technique against LINUX_INJECTIONS (7 techniques). Windows-only techniques are rejected with a clear error when --os linux is set.
| Category | Techniques |
|---|---|
Remote (need --process) | ptrace_inject, process_vm_writev |
| Userland | mmap_jit, signal_handler, dlopen_memfd, mprotect_shellcode |
| Local | memfd_exec |
For remote techniques, --process names the target (e.g. bash, python3, or a full path):
python main.py --os linux process_vm_writev -s sc.bin --process /usr/bin/python3 -o vmw
Encoding applies; evasion is Windows-only
The three shellcode encodings (plain, -w, -x) work identically on Linux — the decoders live in templates/common/decoders/.
The evasion layer (pre-execution hooks, sandbox checks, and environmental keying) is Windows-only: all of its templates live under templates/windows/evasion/, and there is no linux/evasion/ directory. Do not combine --evasion, --sandbox, or --key-source with --os linux.