When it comes to the NTLMSSP challenge, apart from the challenge it self,
it also contains what looks like an NDR encoded top level ref to the
domain, this time in UCS2-LE, and then another NDR encoded top level ref
to what looks like another BLOB. This blob seems to contain:
Richard,
Please see
Hi,
The contents of the NTLMSSP blobs looks interesting ... The NTLMSSP
Negotiate blob contains the flags and the Calling workstation and calling
domain in ASCII. This looks very much like NDR encoded stuff.
When it comes to the NTLMSSP challenge, apart from the challenge it self,
it also
