metasploit-framework

Rex::Proto::NTLM::Message.process_type3_message

Process Type 3 NTLM Message (in Base64)

from http://www.innovation.ch/personal/ronald/ntlm.html

struct {
	byte  protocol[8];  // 'N', 'T', 'L', 'M', 'S', 'S', 'P', '\0'
	byte  type;         // 0x03
	byte  zero[3];

	short lm_resp_len;  // LanManager response length (always 0x18)
	short lm_resp_len;  // LanManager response length (always 0x18)
	short lm_resp_off;  // LanManager response offset
	byte  zero[2];

	short nt_resp_len;  // NT response length (always 0x18)
	short nt_resp_len;  // NT response length (always 0x18)
	short nt_resp_off;  // NT response offset
	byte  zero[2];

	short dom_len;      // domain string length
	short dom_len;      // domain string length
	short dom_off;      // domain string offset (always 0x40)
	byte  zero[2];

	short user_len;     // username string length
	short user_len;     // username string length
	short user_off;     // username string offset
	byte  zero[2];

	short host_len;     // host string length
	short host_len;     // host string length
	short host_off;     // host string offset
	byte  zero[6];

	short msg_len;      // message length
	byte  zero[2];

	short flags;        // 0x8201
	byte  zero[2];

	byte  dom[*];       // domain string (unicode UTF-16LE)
	byte  user[*];      // username string (unicode UTF-16LE)
	byte  host[*];      // host string (unicode UTF-16LE)
	byte  lm_resp[*];   // LanManager response
	byte  nt_resp[*];   // NT response
} type_3_message

Source | Google | Stack overflow