You want to use BNLS_HASHDATA (0x0b).
Generally, you want this format:
C->BNLS 0x0b
(DWORD) Length of password, including the null terminator
(DWORD) 0x02 (flag HASHDATA_FLAG_DOUBLEHASH)
(String) Password, including null terminator
(DWORD) Client key, a randomly-generated value
(DWORD) Server key, or "server token" issued by the server in BNCS -> C 0x50.