Buffer Overflow in Steema TeeChart ActiveX Control (Schneider Electric Historian Products)

This repository contains a single Metasploit exploit module targeting an integer overflow vulnerability (CVE-2011-4034) in the TeeChart Professional ActiveX control (TeeChart2010.ocx and earlier). The exploit is delivered via a malicious HTML page served by the Metasploit framework's HTTP server. When a vulnerable version of Internet Explorer (IE6, IE7, or IE8 with Java support) visits the page, JavaScript triggers the AddSeries() method of the vulnerable ActiveX control, causing an integer overflow and enabling arbitrary code execution. The exploit includes logic to select the appropriate target based on the User-Agent string and supports DEP/ASLR bypasses for IE8 using Java and ROP chains. The payload is customizable and generated by Metasploit, typically resulting in a reverse shell or Meterpreter session. The module references several vulnerable versions of the TeeChart ActiveX control and their CLSIDs, and is known to be used in SCADA systems such as Unitronics OPC server and BACnet Operator Workstation. The code is written in Ruby and is structured as a standard Metasploit module.