Using rainbow tables to obtain the first 7 characters of a windows password(LM/NTLMv1)

Question

I am trying to understand how an attacker is able to use the halflm challenge rainbow table to obtain the first 7 characters of a windows password that was used to authenticate a user using LM/NTLMv1. To help you understand my confusion, consider this illustrative example:

• Suppose a user(U) intends to authenticate on a server S.
• An attacker(A) uses a Mitm attack to pretend to be the S.
• Then U will send a LM response to the fixed challenge(C) string sent by the attacker.

Am I correct in my understanding that:

• A can create a rainbow table(R) whose key is the first 8 characters of the challenge response and whose value is the first 7 characters of the Lanman hash(stored locally in the SAM file).
• obtaining the first 7 characters of the lanman hash is a matter of performing a lookup on R.

My Question: How does the attacker convert the first 7 characters of the lanman hash to the first 7 characters of the password? The reason I ask is because, to my understanding computing the lanman hash is done by splitting the password into 2 7 character blocks and then using each block to obtain 8 bytes of the lanman hash.

A roundabout way of asking my question is: Wouldnt the attacker need the first 8 bytes of the lanman hash to compute the first 7 characters of the password? If so then how does the attacker obtain the 8th character in the lanman hash(the first 7 are trivial if my understanding is right).