Default payloads
The default payload plugin provides core payload generation for Windows agents, supporting both x64 and x86 architectures. All common payload types are available - executable, DLL, service, shellcode, and debug executable.
Plugin ID: shelldot.payload.default
Template ID (x64): shelldot.payload.windows-x64
Template ID (x86): shelldot.payload.windows-x86
Supported types: DEBUG_EXECUTABLE, EXECUTABLE, SERVICE, DLL, SHELLCODE
Configuration
Use the table below to customize how the Default Payload behaves.
| Attribute | Required | Default | Explanation |
|---|---|---|---|
| type | Yes | None | The payload type. Options: DEBUG_EXECUTABLE, EXECUTABLE, SERVICE, DLL, SHELLCODE. |
| paddingSize | No | 0 |
Number of bytes of NULL-padding appended to the payload. Positive values inflate the file size; zero, negative, or omitted values add no padding. |
| initialWait | No | 0 |
Seconds to wait after startup before launching the main payload code. Positive values add a delay; zero, negative, or omitted values add no delay. |
| dllMethodName | No | bob |
The exported method name used by DLL-type payloads. An empty value also uses bob. |
| mutex | No | Not set | A string-based mutex that prevents the payload from launching multiple concurrent instances with the same mutex value on the same machine. |
| guardrails[] | No | Empty | Conditions that must be met before the payload starts execution. |
| ↳ type | Per entry | None | Guardrail type. Options: DomainExists, DomainNotExists, TimeBefore, TimeAfter. |
| ↳ value | Per entry | None | For DomainExists/DomainNotExists: a hostname. For TimeBefore/TimeAfter: an ISO-8601 timestamp. |