I've grown increasingly fond of the smb-pwdump.nse script within nmap. You'll have to bring in the pwdump exe and dll for it to work properly, but it works remotely without having to exploit the...

apt-cache search packagename

I thought this was obvious. What would be the point of releasing a VMWare image if it didn't save changes? Otherwise you could just boot a VM to the iso.

I might have to pull out encase to test this out.

I'll just use Cain & Abel if I must use windows.