Merge constants for reponses wordcounts

lib/msf/core/exploit/smb/server/share/command/close.rb

@@ -19,7 +19,7 @@ module Msf
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_CLOSE
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
-            pkt['Payload']['SMB'].v['WordCount'] = 0
+            pkt['Payload']['SMB'].v['WordCount'] = CONST::SMB_CLOSE_RES_WORD_COUNT
 
             c.put(pkt.to_s)
           end

lib/msf/core/exploit/smb/server/share/command/negotiate.rb

@@ -47,7 +47,7 @@ module Msf
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_NEGOTIATE
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
-            pkt['Payload']['SMB'].v['WordCount'] = 17
+            pkt['Payload']['SMB'].v['WordCount'] = CONST::SMB_NEGOTIATE_RES_WORD_COUNT
             pkt['Payload'].v['Dialect'] = dialect
             pkt['Payload'].v['SecurityMode'] = security_mode
             pkt['Payload'].v['MaxMPX'] = max_mpx

lib/msf/core/exploit/smb/server/share/command/nt_create_andx.rb

@@ -59,7 +59,7 @@ module Msf
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_NT_CREATE_ANDX
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
-            pkt['Payload']['SMB'].v['WordCount'] = 42
+            pkt['Payload']['SMB'].v['WordCount'] = CONST::SMB_NT_CREATE_ANDX_RES_WORD_COUNT
             pkt['Payload'].v['AndX'] = CONST::SMB_COM_NO_ANDX_COMMAND
             pkt['Payload'].v['OpLock'] = CONST::LEVEL_II_OPLOCK # Grant Oplock on File
             pkt['Payload'].v['FileID'] = file_id

lib/msf/core/exploit/smb/server/share/command/read_andx.rb

@@ -36,7 +36,7 @@ module Msf
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_READ_ANDX
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
-            pkt['Payload']['SMB'].v['WordCount'] = 12
+            pkt['Payload']['SMB'].v['WordCount'] = CONST::SMB_READ_ANDX_RES_WORD_COUNT
             pkt['Payload'].v['AndX'] = CONST::SMB_COM_NO_ANDX_COMMAND
             pkt['Payload'].v['Remaining'] = 0xffff
             pkt['Payload'].v['DataLenLow'] = data_len_low

lib/msf/core/exploit/smb/server/share/command/session_setup_andx.rb

@@ -10,7 +10,7 @@ module Msf
           #
           def smb_cmd_session_setup_andx(c, buff)
             tree_connect_response = CONST::SMB_TREE_CONN_ANDX_RES_PKT.make_struct
-            tree_connect_response.v['WordCount'] = 7
+            tree_connect_response.v['WordCount'] = CONST::SMB_TREE_CONN_ANDX_WORD_COUNT
             tree_connect_response.v['AndXCommand'] = CONST::SMB_COM_NO_ANDX_COMMAND
             tree_connect_response.v['AndXReserved'] = 0
             tree_connect_response.v['AndXOffset'] = 0
@@ -47,7 +47,7 @@ module Msf
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_SESSION_SETUP_ANDX
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
-            pkt['Payload']['SMB'].v['WordCount'] = 3
+            pkt['Payload']['SMB'].v['WordCount'] = CONST::SMB_SESSION_SETUP_ANDX_RES_WORD_COUNT
             pkt['Payload'].v['AndX'] = andx
             pkt['Payload'].v['Reserved1'] = reserved
             pkt['Payload'].v['AndXOffset'] = andx_offset

lib/msf/core/exploit/smb/server/share/command/trans2.rb

@@ -45,7 +45,7 @@ module Msf
             pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_TRANSACTION2
             pkt['Payload']['SMB'].v['Flags1'] = FLAGS
             pkt['Payload']['SMB'].v['Flags2'] = FLAGS2
-            pkt['Payload']['SMB'].v['WordCount'] = 10
+            pkt['Payload']['SMB'].v['WordCount'] = CONST::SMB_TRANS2_RES_WORD_COUNT
             pkt['Payload'].v['ParamCountTotal'] = parameters.to_s.length
             pkt['Payload'].v['DataCountTotal'] = data.to_s.length
             pkt['Payload'].v['ParamCount'] = parameters.to_s.length

lib/rex/proto/smb/constants.rb

@@ -412,6 +412,15 @@ class Constants
   SMB_RESOURCE_FILE_TYPE_PRINTER = 0x0003
   SMB_RESOURCE_FILE_TYPE_COMM_DEVICE = 0x0004
 
+  # Word count values
+  SMB_NEGOTIATE_RES_WORD_COUNT = 0x11
+  SMB_CLOSE_RES_WORD_COUNT = 0x00
+  SMB_NT_CREATE_ANDX_RES_WORD_COUNT = 0x22
+  SMB_READ_ANDX_RES_WORD_COUNT = 0x0c
+  SMB_TREE_CONN_ANDX_WORD_COUNT = 0x07
+  SMB_SESSION_SETUP_ANDX_RES_WORD_COUNT = 0x03
+  SMB_TRANS2_RES_WORD_COUNT = 0x0a
+
   # SMB Dialect Compatibility
   DIALECT = {}