First AD hack options

Hello guys,
I'm struggling to hack my lab on AD. I attempt to get a first hash in an environnement with a Domain Controler and a few machines. Keep in mind that I have no access to the target, then I can't reboot ot, or call a shared file, or anything else. And there is nobody working since it's a lab. I want to get the hash with no "human" action from the target.
Please what do you advice ? MITM6 ? anything else ?

I was wondering if scans as Nessus and Nmap would simulate some traffic from those particular ports, since it works like a handshake, the answers would generate something ?

For example an SMB scan, would give some data back to the attacker and generate a hash ?

And what y'all think about launching mitm6, ntlmrelayx, and responder at the same time ?

Thanks

submitted by /u/Known_Personality_80
[link] [comments]

from hacking: security in practice https://ift.tt/HvxiKUk