Remote Code Execution via HSCRemoteDeploy ActiveX in Honeywell EBI

This repository contains a single Metasploit module targeting a remote code execution vulnerability (CVE-2013-0108) in the Honeywell HSC Remote Deployer ActiveX control, typically installed with Honeywell EBI R410.1 on Windows. The exploit works by serving a malicious HTML page to Internet Explorer users, which instantiates the vulnerable ActiveX control and calls its LaunchInstaller() method to execute an arbitrary HTA file hosted by the attacker's server. The HTA file, in turn, drops and executes a payload (such as Meterpreter) on the victim's machine using VBS scripting and ADODB.Stream. The module is operational and allows for customizable payloads. The main attack vector is via browser exploitation over the network, requiring the victim to visit a malicious page with Internet Explorer. The module defines fingerprintable endpoints such as the HTA payload path and the ActiveX CLSID. The code is structured as a typical Metasploit exploit module, with clear separation of initialization, payload generation, and HTTP request handling.