Linux payload

Native Linux agent for the commercial tier. Supports core agent commands plus Linux-specific operations like sh, chmod, and in-memory ELF execution via load-elf.

Plugin ID: shelldot.payload.linux

Template ID (x64): shelldot.payload.linux-x64

Supported types: DEBUG_EXECUTABLE, EXECUTABLE, LIBRARY

These types describe the generated payload itself. Its command and listener ExecUnits use Linux native libraries; see ExecUnit Execution on Linux for their compatibility and communication model.

Info

Currently limited to x64 systems. Does not include advanced shellcode features. Compatibility issues may occur on significantly older systems or distributions not based on Debian.

Configuration

Attribute	Required	Default	Explanation
type	Yes	None	The payload type. Options: DEBUG_EXECUTABLE, EXECUTABLE, LIBRARY.
initialWait	No	0	Seconds to wait after startup before launching the main payload code.
paddingSize	No	0	Number of bytes of NULL-padding appended to the payload. Positive values normally inflate the file size; zero, negative, or omitted values add no padding. Padding is not applied when listener data is appended rather than embedded in the template.
disableMemFd	No	false	When true, the agent executes plugin code using temporary files instead of memfd_create. This can help evade detection by certain EDR solutions that monitor memfd usage.
pluginLoadingDirectory	No	Not set	Directory used for temporary files when disableMemFd is enabled. Falls back to /tmp, then to the directory containing the agent executable if the specified path is unavailable.
customTemplate	No	Built-in template	A filename or relative path beneath this plugin's configured template directory, or a direct http: or https: URL.
mutex	No	Not set	A string-based mutex that prevents the payload from launching multiple concurrent instances with the same mutex value on the same machine.
autoDestructDate	No	Not set	ISO-8601 timestamp after which the agent will terminate itself automatically.