Hy there

Actually i'm working on the same Goals...
Today, i tried with ARP Poising to sniff some Hashes from the Domain Controller, without luck ;-)
(But, i didn't spend a lot of time...)
...