Match an artifact to its executable consumer and runtime

Needs: Matching OS/process architecture, interpreter/loader/runtime, intact bytes, execute/destination permissions and compatible format

Record all of these

# Record all of these
target OS and build
target process architecture
artifact format
loader/interpreter
execution identity and integrity
working directory and PATH
required runtime/libraries
arguments and quoting
network direction
handler protocol

4.1 Linux checks

# 4.1 Linux checks
uname -a
uname -m
file PAYLOAD
readelf -h PAYLOAD | sed -n '1,25p'
ldd PAYLOAD
ls -l PAYLOAD
findmnt -T /PATH/TO/PAYLOAD
head -n 1 SCRIPT

Exec format error: wrong format/architecture or invalid interpreter line;

Permission denied: missing execute permission, inaccessible parent directory, noexec, policy or identity issue;

No such file or directory when the file exists: missing dynamic loader or broken shebang interpreter;

missing shared object: runtime library mismatch;

^M in a shebang: CRLF line endings changed the interpreter path;

works interactively but not through cron/service: environment, working directory, shell, identity or route differs.

4.2 Windows checks

# 4.2 Windows checks
Get-CimInstance Win32_OperatingSystem |
  Select-Object Caption,Version,BuildNumber,OSArchitecture

[Environment]::Is64BitOperatingSystem
[Environment]::Is64BitProcess
$env:PROCESSOR_ARCHITECTURE
Get-AuthenticodeSignature -FilePath 'C:\PATH\PAYLOAD.exe'

Keep OS architecture and consumer-process architecture separate. A 64-bit OS can run a 32-bit process under WOW64; injected code and DLLs must match the process they enter. A normal executable is not necessarily a service executable, DLL, MSI or script:

Verify → Verify matching bytes, consumer and actual minimal execution effect; on Windows inspect PE architecture/runtime and resulting process.

If it fails → Permission, mount policy, CRLF/shebang, missing runtime and architecture mismatches require different fixes. More detail ↓

If → then

An existing C/C++ or platform-specific PoC matches the candidate → Compile and minimally adapt an existing native or memory-corruption PoC
Needs: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants
An existing exploit/delivery primitive needs a binary or raw payload → Generate a payload matching OS, process, format and handler
Needs: Verified target/process architecture, delivery format, callback route, payload constraints and a matching staged/stageless listener
A simple command works while a longer or nested payload fails → Repair quoting, encoding and command-length boundaries
Needs: Known outer request/template/database parser and inner shell; correct character encoding and transport length
An assigned client-side scenario includes Office and a document-open interaction → Use a gated Office macro delivery chain
Needs: Compatible installed Office/macro support, a real required user interaction, executable document state and allowed macro/security policy
A client-side scenario permits a Library file and remote share presentation → Use a Windows Library/WebDAV/shortcut chain with explicit interaction
Needs: Compatible Windows consumer, reachable WebDAV resource, correctly handled shortcut and required user launch; policy permits the action

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Match an artifact to its executable consumer and runtime

USE WHEN: A downloaded/generated artifact exists but does not run
STARTING ACCESS: A recorded delivery/execution chain with the expected consumer and effect
RESULT: A correctly identified artifact/runtime boundary and a suitable execution choice

Recognize the clue

Inspect a transferred/generated artifact's bytes, executable format and required consumer/loader before interpreting runtime errors.

file FILE
sha256sum FILE
readelf -l FILE 2>/dev/null
uname -m

SYNTHETIC EXAMPLE OUTPUT

FILE: ELF 32-bit
Requested interpreter: /PATH/TO/LOADER
Execution error: No such file or directory

Means: An existing file can fail because its loader/runtime is missing; this is separate from callback failure.

Confirm: Verify exact architecture, loader/runtime, permissions, mount policy, line endings and integrity.

After validation: The matching consumer loads intact bytes and the minimal effect works: choose that artifact.
Ruled out in this context: A PE/ELF/DLL or architecture mismatch is incompatible with the intended consumer: reject that artifact.
Still inconclusive: A file-exists check without loader/hash evidence leaves the failure layer unresolved.

Troubleshooting: Permission, mount policy, CRLF/shebang, missing runtime and architecture mismatches require different fixes.

The file extension is not the execution contract. Record all of these:

4.1 Linux checks

Common interpretations:

Exec format error: wrong format/architecture or invalid interpreter line;
Permission denied: missing execute permission, inaccessible parent directory, noexec, policy or identity issue;
No such file or directory when the file exists: missing dynamic loader or broken shebang interpreter;
missing shared object: runtime library mismatch;
^M in a shebang: CRLF line endings changed the interpreter path;
works interactively but not through cron/service: environment, working directory, shell, identity or route differs.

4.2 Windows checks

Keep OS architecture and consumer-process architecture separate. A 64-bit OS can run a 32-bit process under WOW64; injected code and DLLs must match the process they enter. A normal executable is not necessarily a service executable, DLL, MSI or script:

Consumer	Required property / common failure
Direct process creation	Compatible PE/ELF/script and dependencies
Windows service	Service-compatible entry/control behavior; error 1053 may follow execution of a non-service program
DLL loader/hijack	Correct bitness, expected exports and dependency behavior
`msiexec`	Valid MSI package, not an EXE renamed `.msi`
PowerShell	Valid syntax, edition/runtime compatibility and applicable policy/control state
Existing memory-corruption PoC	Documented architecture, space, bad characters and exit behavior

Why it works

A file may exist while its dynamic loader is missing. A 64-bit OS can host a 32-bit consumer, and a DLL is not interchangeable with an EXE or script.

Worked example · hypothetical

Observation: Linux says not found for an existing executable. Test: inspect its ELF interpreter and architecture. Illustrative output: the required loader is absent. Interpretation: choose a compatible artifact rather than changing callback IPs.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗