Use CmdStagerVBS instead of CmdStagerTFTP

By using `php.exe` as stager, the bad characters can be completely bypassed. This allows the use of the CmdStagerVBS, which should be working on all supported Windows systems.