exploits: Set tftphost option for modules which use Windows TFTP stager

[bcoles]

Windows exploit modules which use the TFTP command stager require a tftphost option to be set (rapid7/rex-exploitation#34 rapid7/rex-exploitation#31).

This PR adds this option to the following modules (all modules which force set 'CmdStagerFlavor' => 'tftp'):

• modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
• modules/exploits/multi/http/struts_code_exec.rb
• modules/exploits/windows/antivirus/ams_xfr.rb
• modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb
• modules/exploits/windows/http/osb_uname_jlist.rb
• modules/exploits/windows/iis/msadc.rb
• modules/exploits/windows/misc/altiris_ds_sqli.rb
• modules/exploits/windows/mssql/mssql_payload.rb

It does not patch modules/exploits/windows/iis/ms01_026_dbldecode.rb as this is addressed in #16724.

Note: Many of these modules likely won't work for other reasons (such as using a Meterpreter payload by default). Fixing the TFTP stager means at least one less thing is broken. set HttpTrace true can be used to show the before and after effect of this patch.

[bcoles]

cgifname does nothing. It is copy pasta from a couple of other Windows modules developed around the same time and use a similar code pattern. It has been removed.

[bcoles]

This module, like ms01_026_dbldecode, expects the TFTP command stager to generate commands without concatenation as it needs to strip the start command. This is the default behavior for the stager; however, it won't be the default once rapid7/rex-exploitation#34 is merged. Thus noconcat was added.

[space-r7]

Release Notes

Modules that use the tftp command stager fail due to a missing tftphost option. This ensures that the tftphost host is set and valid before proceeding with creating the command stager.