Update for enum_prefetch post module

Hi.

This is an update for my enum_prefetch post module. The main changes are how & where the module collects timestamp information. I've also added a function that collects the executable file paths saved in the prefetch files and prints the file path that matches with the executable filename stored inside the prefetch file. 


Timestamps:
-  Old: Previous version timestamp information was collected by getting MACE-times from the actual executables stored wherever they were stored.

- New: This version collects timestamp information from inside the prefetch file. It takes the last run 64bit FILETIME and convert it to UTC which will be presented to the user. This also means enum_prefetch no longer requires SYSTEM privileges on WinXP and it'll work as ADMIN (but also that it contains only the last run timestamp).

Filepaths:
- New: I've added a function that searches for the offsets where each prefetch file saves the file path data and uses  that to find the execution path of the executable. This allows the user to see from where the files that have a prefetch file have been executed.

msftidy & rspec:

```
(prefetch_update) debian@debian-msf:~/Github/metasploit-framework$ ./tools/msftidy.rb ./modules/post/windows/gather/enum_prefetch.rb 
(prefetch_update) debian@debian-msf:~/Github/metasploit-framework$

(prefetch_update) debian@debian-msf:~/Github/metasploit-framework$ rake spec/
(prefetch_update) debian@debian-msf:~/Github/metasploit-framework$
```

Testrun as restricted user on WinXP:
```
meterpreter > run post/windows/gather/enum_prefetch 

[*] Prefetch Gathering started.
[-] You don't have enough privileges. Try getsystem.
meterpreter > sysinfo 
Computer        : XP-E49FE0852877
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > getuid
Server username: XP-E49FE0852877\restricted_user
meterpreter > 
```

Testrun as admin on WinXP:
```
meterpreter > sysinfo 
Computer        : XP-E49FE0852877
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > getuid
Server username: XP-E49FE0852877\xp-user
meterpreter > run post/windows/gather/enum_prefetch 

[*] Prefetch Gathering started.
[+] Detected Windows XP (Build 2600, Service Pack 3). (max 128 entries)
[+] EnablePrefetcher Value: (3) = Applaunch and boot enabled (Default Value, excl. Win2k3).
[+] Remote: Timezone is FLE Standard Time.
[+] Remote: Localtime bias to UTC: +119 minutes.
[+] Current UTC Time: 2013-12-08 16:49:32 UTC
[*] Gathering information from remote system. This will take awhile..

Prefetch Information
====================

 Last execution (filetime)  Run Count  Hash  Filename                       Filepath
 -------------------------  ---------  ----  --------                       --------
 2013-11-10 20:38:46 UTC    085CFFDE   1     NETSH.EXE                      \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\NETSH.EXE
 2013-11-10 20:44:08 UTC    2395F30B   8     IPCONFIG.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\IPCONFIG.EXE
 2013-11-11 06:30:07 UTC    282F76A7   1     SPOOLSV.EXE                    \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SPOOLSV.EXE
 2013-11-11 06:30:16 UTC    3530F672   3     SVCHOST.EXE                    \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\SVCHOST.EXE
 2013-11-11 06:30:16 UTC    20DB6D1B   1     LSASS.EXE                      []
 2013-11-11 06:30:20 UTC    30411B02   1     MSOOBE.EXE                     \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\OOBE\MSOOBE.EXE
 2013-11-11 06:30:30 UTC    0F138680   1     ALG.EXE                        \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\ALG.EXE
 2013-11-11 06:30:32 UTC    002E45AB   1     AGENTSVR.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\MSAGENT\AGENTSVR.EXE
 2013-11-11 06:30:58 UTC    1C8143D1   1     DPSFNSHR.EXE                   \DEVICE\HARDDISKVOLUME1\DPSFNSHR.EXE
 2013-11-11 06:30:59 UTC    3189D4D7   4     DEVCON.EXE                     \DEVICE\HARDDISKVOLUME1\DEVCON.EXE
 2013-11-11 06:31:23 UTC    1E854676   1     RUNDLL32.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\RUNDLL32.EXE
 2013-11-11 06:31:25 UTC    49F747DB   1     RUNDLL32.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\RUNDLL32.EXE

[...SNIP...]

2013-12-08 16:51:05 UTC    082F38A9   11    EXPLORER.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\EXPLORER.EXE
 2013-12-08 16:51:06 UTC    34E05E26   10    VBOXTRAY.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\VBOXTRAY.EXE
 2013-12-08 16:51:06 UTC    3667BD89   31    VERCLSID.EXE                   \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\VERCLSID.EXE
 2013-12-08 16:51:06 UTC    0E17969B   11    CTFMON.EXE                     \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CTFMON.EXE
 2013-12-08 16:51:08 UTC    087B4001   44    CMD.EXE                        \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\CMD.EXE
 2013-12-08 16:51:14 UTC    0E5F0F72   56    METERPRETER_REVERSE_TCP.EXE    \DEVICE\HARDDISKVOLUME1\DOCUMENTS AND SETTINGS\XP-USER\DESKTOP\METERPRETER_REVERSE_TCP.EXE
 2013-12-08 16:51:20 UTC    399A8E72   27    WUAUCLT.EXE                    \DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\WUAUCLT.EXE


[*] Finished gathering information from prefetch files.
[*] Results stored in: /home/debian/.msf4/loot/20131208185007_development_10.2.2.12_prefetch_info_299743.txt
meterpreter > 

```

Testrun as restricted user on Win7:
```
meterpreter > sysinfo 
Computer        : WIN7-USER-PC
OS              : Windows 7 (Build 7600).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > getuid
Server username: WIN7-USER-PC\user1
meterpreter > run post/windows/gather/enum_prefetch 

[*] Prefetch Gathering started.
[-] You don't have enough privileges. Try getsystem.
meterpreter > 
```

Testrun as admin on Win7:
```
meterpreter > sysinfo 
Computer        : WIN7-USER-PC
OS              : Windows 7 (Build 7600).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > getuid
Server username: WIN7-USER-PC\WIN7-USER
meterpreter > run post/windows/gather/enum_prefetch 

[*] Prefetch Gathering started.
[+] Detected Windows 7 (Build 7600). (max 128 entries)
[+] EnablePrefetcher Value: (3) = Applaunch and boot enabled (Default Value, excl. Win2k3).
[+] Remote: Timezone is FLE Standard Time.
[+] Remote: Localtime bias to UTC: +119 minutes.
[+] Current UTC Time: 2013-12-08 16:59:49 UTC
[*] Gathering information from remote system. This will take awhile..

Prefetch Information
====================

 Last execution (filetime)  Run Count  Hash  Filename                       Filepath
 -------------------------  ---------  ----  --------                       --------
 2013-11-17 14:31:17 UTC    007FEA55   1     SVCHOST.EXE                    \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SVCHOST.EXE
 2013-11-17 14:31:57 UTC    DF44F913   1     NET.EXE                        \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NET.EXE
 2013-11-17 14:31:57 UTC    849DA590   1     NET1.EXE                       \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\NET1.EXE
 2013-11-17 14:31:58 UTC    6B089E8B   1     VDSLDR.EXE                     \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\VDSLDR.EXE
 2013-11-17 14:31:58 UTC    6E7946F9   1     VDS.EXE                        \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\VDS.EXE
 2013-11-17 14:33:24 UTC    2E9C6FE2   1     FINDSTR.EXE                    \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\FINDSTR.EXE
 2013-11-17 14:33:25 UTC    A990CB86   1     ATTRIB.EXE                     \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\ATTRIB.EXE
 2013-11-17 14:33:26 UTC    1C97BF89   1     BOOTINST.EXE                   \DEVICE\HARDDISKVOLUME2\WINDOWS\SETUP\SCRIPTS\BOOTINST.EXE
 2013-11-17 14:33:27 UTC    9046403A   4     DISKPART.EXE                   \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\DISKPART.EXE
 2013-11-17 14:33:28 UTC    E7D5C9CC   2     SHUTDOWN.EXE                   \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SHUTDOWN.EXE
 2013-11-17 14:36:16 UTC    EE01DD11   1     VBOXWINDOWSADDITIONS.EXE       []
 2013-11-17 14:36:21 UTC    C4ADF8B8   1     VBOXWINDOWSADDITIONS-X86.EXE   []
 2013-11-17 14:37:06 UTC    7A9F33D1   1     NSE3F0.TMP                     \DEVICE\HARDDISKVOLUME2\USERS\WIN7-USER\APPDATA\LOCAL\TEMP\NSK360D.TMP\NSE3F0.TMP
 2013-11-17 14:37:06 UTC    945D79AE   2     SC.EXE                         \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SC.EXE

[...SNIP...]

2013-12-08 17:05:34 UTC    A80E4F97   13    EXPLORER.EXE                   \DEVICE\HARDDISKVOLUME2\WINDOWS\EXPLORER.EXE
 2013-12-08 17:05:36 UTC    1D286C83   7     VBOXTRAY.EXE                   \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\VBOXTRAY.EXE
 2013-12-08 17:05:42 UTC    4A81B364   18    CMD.EXE                        \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE
 2013-12-08 17:05:42 UTC    1F3E9D7E   29    CONHOST.EXE                    \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE
 2013-12-08 17:05:46 UTC    FC0D39BF   20    WMPNSCFG.EXE                   \DEVICE\HARDDISKVOLUME2\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE
 2013-12-08 17:05:51 UTC    531BD9EA   19    CONSENT.EXE                    []
 2013-12-08 17:06:07 UTC    EBAA25DC   28    METERPRETER_REVERSE_TCP.EXE    \DEVICE\HARDDISKVOLUME2\USERS\WIN7-USER\DESKTOP\METERPRETER_REVERSE_TCP.EXE
 2013-12-08 17:06:19 UTC    05F624AB   14    SVCHOST.EXE                    \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SVCHOST.EXE
 2013-12-08 17:07:07 UTC    1628051C   18    WMIPRVSE.EXE                   \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WBEM\WMIPRVSE.EXE


[*] Finished gathering information from prefetch files.
[*] Results stored in: /home/debian/.msf4/loot/20131208190046_development_10.2.2.14_prefetch_info_624362.txt
meterpreter > 
```

Testrun as restricted user on Win2k3:
```
meterpreter > sysinfo 
Computer        : WIN2K3-A5C2D0FB
OS              : Windows .NET Server (Build 3790, Service Pack 2).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > getuid
Server username: WIN2K3-A5C2D0FB\restricted_user
meterpreter > run post/windows/gather/enum_prefetch 

[*] Prefetch Gathering started.
[-] You don't have enough privileges. Try getsystem.
meterpreter >
```

Testrun as admin on Win2k3:
```
meterpreter > sysinfo 
Computer        : WIN2K3-A5C2D0FB
OS              : Windows .NET Server (Build 3790, Service Pack 2).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > getuid
Server username: WIN2K3-A5C2D0FB\Administrator
meterpreter > run post/windows/gather/enum_prefetch 

[*] Prefetch Gathering started.
[+] Detected Windows .NET Server (Build 3790, Service Pack 2). (max 128 entries)
[+] EnablePrefetcher Value: (2) = Boot prefetching enabled (Non-Default, excl. Win2k3).
[+] Remote: Timezone is Pacific Standard Time.
[+] Remote: Localtime bias to UTC: -480 minutes.
[+] Current UTC Time: 2013-12-08 17:08:31 UTC
[*] Gathering information from remote system. This will take awhile..

Prefetch Information
====================

 Last execution (filetime)  Run Count  Hash  Filename  Filepath
 -------------------------  ---------  ----  --------  --------
 2013-12-09 03:04:53 UTC    B00DFAAD   1     NTOSBOOT  []


[*] Finished gathering information from prefetch files.
[*] Results stored in: /home/debian/.msf4/loot/20131208190832_development_10.2.2.17_prefetch_info_863817.txt
meterpreter >
```