When I use the nbns_repsonde module in metasploit, and set it to write captured responses to a file in the john format, I get a file with lines such as this:
username::DOMAIN:stringof32numbersandletters:stringof32numbersandletters:1122334455667788
This is for a http-netntlm response. Where I have written stringof32numbersandletters represents the hash, and both are identical.
However, for http-ntlmv2, the format completely changes:
username::DOMAIN:1122334455667788:stringof32numbersandletters:muchlargerstringofrandomnumbersandletters
The username and domain is obvious, as is the challenge sent by Metasploit (1122334455667788), but it is the rest that I find confusing.
I am new to learning about hashes, and pass the hash attacks and such, and I'm not sure how to make sense of what I have captured.
I can't find any documentation on the Metasploit homepage for the module: http://www.rapid7.com/db/modules/auxiliary/spoof/nbns/nbns_response
Where can I find documentation that explains what each segment is, and what each hash is for? Or, alternatively, would someone be able to explain the difference between a captured ntlm and ntlmv2 response?
Furthermore, the recorded hashes written to file do not seem to match what is on screen. Looking at examples taken from: http://www.anotherwayin.net/2011/07/netbios-spoofing-for-easy-win.html
The contents in this file:
Do not match what was captured and shown on screen via the module