- opens cmd
- opens [app], e.g open calc
- Puts active window in full screen
- Closes active window
- minimises active window
- types str, e.g type hello, NOTE if user types "type hello there", everthing after "hello" is ignored
- takes screenshot and sends it to attacker in the way it was configured
- simulates Enter key
- Pretty self explanatory
- Creates a reverse shell, type exit to break out
- list directory using dir(Windows only)
- the tcp_reverse command takes attacker input runs them in a shell on on the victim's machine , sends the output and closes the shell. To circumvent this, you may need to chain commands using the && operator