Add disk-less AV bypass PSExec module using PSH

This commit rewires the existing work on PSExec performed by R3dy,
HDM, and countless others, to execute a powershell command instead
of a binary written to the disk. This particular iteration uses
PSH to call .NET, which pull in WINAPI functions to execute the
shellcode in memory. The entire PSH script is compressed with ZLIB,
given a decompressor stub, encoded in base64 and executed directly
from the command-line with powershell -EncodedCommand.

In practice, this prevents us from having to write binaries with
shellcode to the target drive, deal with removal, or AV detection
at all. Moreover, the powershell wrapper can be quickly modified
to loop execution (included), or perform other obfu/delay in order
to confuse and evade sandboxing and other HIDS mechanisms.

This module has been tested with x86/x64 reverse TCP against win6,
win7 (32 and 64), and Server 2008r2. Targets tested were using
current AV with heuristic analysis and high identification rates.
In particular, this system evaded Avast, KAV current, and MS' own
offerings without any issue. In fact, none of the tested AVs did
anything to prevent execution or warn the user.

Lastly, please note that powershell must be running in the same
architecture as the payload being executed, since it pulls system
libraries and their functions from unmanaged memory. This means
that when executing x86 payloads on x64 targets, one must set the
RUN_WOW64 flag in order to forcibly execute the 32bit PSH EXE.
psexec_psh cleanup
allow psh to run in background via cmd start
hide window
add libs from #1379 and allow psh 1.0 exec against older hosts
This commit completes powershell based psexec

The original module suffered from a small problem - interactive
process notification from Desktop 0 for users currently logged in.
Although acheiving full AV evasion, we were setting off UserAlert.
This commit updates the module itself to match #1379 in R7's repo.
The size of powershell payloads has been reduced, and a wrapper
added to hide the actual payload process entirely.
Fix multiple issues with memory_grep

This fixes the following:
[FixRM:#8118] - Allows the module to be able to enumerate from
multiple processes with the same name.

[FixRM:#8120] - Allows the module to be able to actually read data
from the heap.
Add has_pid? function

[SeeRM:#8123] - Add commonly used function has_pid?. Related to
redmine issue 8123.
These modules should check PID before using it
post/local_admin_search_enum~Regex fails,module 2
If the regex fails then the entire moudle would too
[FixRM:#8126] -  Use functions from Msf::Post::File

Some functions already exist in Msf::Post::File, should use them.
[FixRM:#8127] - Remove junk code that checks ARTIFACTS again

ARTIFACTS uses OptPath, which already checks the path. We don't need
to do this again.
[FixRM:#8129] - Fix undefined method error in enum_services.rb

srv_conf may not have the 'Startup' key because it's only assigned
in service_info() when srvstart is 4, therefore it's possible to
cause an undefined method 'downcase' error.
[FixRM:#8132] - Fix undefined method '+' in total_commander.rb

The return value of registry_getvaldata can return nil when a
RequestError occurs, so you can't always assume it's gonna throw
you a string.
[FixRM:#8134] - Handle registry_getvaldata return value properly

registry_getvaldata can return nil, can't always assume it's
gonna throw a string.
[SeeRM:#8135] - Be able to show where store_loot saves a file

If you don't print where store_loot saves the file, it can be a
pain in the butt to find it sometimes.
Use execute_shellcode for novell_client_nwfs.rb
Use execute_shellcode for novell_client_nicm.rb
Land #2052 - Fix regex
Merge branch 'psexec_psh' of https://github.com/sempervictus/metasploit-framework into psexec_psh