'Parse the 3rd msg in NTLM handshake
Thanks to psychomario'

def parse_ntlm_resp(self, msg3, seq):

    if (seq in challenge_acks):
        challenge = challenge_acks[seq]
    else:
        challenge = 'CHALLENGE    NOT    FOUND'
    if (len(msg3) > 43):
        (lmlen, lmmax, lmoff, ntlen, ntmax, ntoff, domlen, dommax, domoff, userlen, usermax, useroff) = struct.unpack('12xhhihhihhihhi', msg3[:44])
        lmhash = binascii.b2a_hex(msg3[lmoff:(lmoff + lmlen)])
        nthash = binascii.b2a_hex(msg3[ntoff:(ntoff + ntlen)])
        domain = msg3[domoff:(domoff + domlen)].replace('\x00', '')
        user = msg3[useroff:(useroff + userlen)].replace('\x00', '')
        if (ntlen == 24):
            msg = ('%s    %s' % ('NETNTLMv1:', ((((((((user + '::') + domain) + ':') + lmhash) + ':') + nthash) + ':') + challenge)))
            return msg
        elif (ntlen > 60):
            msg = ('%s    %s' % ('NETNTLMv2:', ((((((((user + '::') + domain) + ':') + challenge) + ':') + nthash[:32]) + ':') + nthash[32:])))
            return msg
