<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
--></style>
</head>
<body class='hmmessage'>
Hi Guys,<br><br>just arrived in the middle of the thread and it's very interesting stuff - I see Keith has success now which is great.<br><br>I'd like to get current opinions regarding best methodology of hash dumping - my last encounter which was several months ago and ended with the DC dropping because of McAfee - yes I've seen the warnings... afterwards.<br><br>Will ver3.0 alpha (and production) negate the need to turn off the AV, or would it still be considered better to get the AV disabled for the period of the audit/test? If this is the case and if part of a pentest, then an agreement would have to be made between customer and tester like 'well I believe I can achieve a hash dump, but a) do you want me to prove it, and b) if you do, then what do you want to do to manage the risk'. <br><br>I read a while ago that Metasploit uses a 'safe' technique now? http://blog.metasploit.com/2010/01/safe-reliable-hash-dumping.html<br><br>What does the floor think?<br><br>Keep up the good work - it's greatly appreciated<br><br><br> <br> <br /><hr />Get a free e-mail account with Hotmail. <a href='http://clk.atdmt.com/UKM/go/197222280/direct/01/' target='_new'>Sign-up now.</a></body>
</html>