Identifying hash format caputred via Metasploit

Question

When I use the nbns_repsonde module in metasploit, and set it to write captured responses to a file in the john format, I get a file with lines such as this:

username::DOMAIN:stringof32numbersandletters:stringof32numbersandletters:1122334455667788

This is for a http-netntlm response. Where I have written stringof32numbersandletters represents the hash, and both are identical.

However, for http-ntlmv2, the format completely changes:

username::DOMAIN:1122334455667788:stringof32numbersandletters:muchlargerstringofrandomnumbersandletters

The username and domain is obvious, as is the challenge sent by Metasploit (1122334455667788), but it is the rest that I find confusing.

I am new to learning about hashes, and pass the hash attacks and such, and I'm not sure how to make sense of what I have captured.

I can't find any documentation on the Metasploit homepage for the module: http://www.rapid7.com/db/modules/auxiliary/spoof/nbns/nbns_response

Where can I find documentation that explains what each segment is, and what each hash is for? Or, alternatively, would someone be able to explain the difference between a captured ntlm and ntlmv2 response?

Furthermore, the recorded hashes written to file do not seem to match what is on screen. Looking at examples taken from: http://www.anotherwayin.net/2011/07/netbios-spoofing-for-easy-win.html

The contents in this file:

Do not match what was captured and shown on screen via the module

Answer 1

username::DOMAIN:1122334455667788:stringof32numbersandletters:muchlargerstringofrandomnumbersandletters

Username: username
Domain or NTLM realm: DOMAIN
Challenge: 1122334455667788
LM Hash: strongof32numbersandletters
NTLM Hash: muchlargerstringofrandomnumbersandletters

If you are wondering why you can't pass these hashes in the pass the hash attack, the reason is that both LM and NTLM hashes are not the same as the ones stored in the SAM or Active Directory store. These hashes are concatenated with the challenge and then send over the wire. The reason of setting a static signature 1122334455667788 is to use the pre-computed rainbow tables generated using this challenge.