LLMNR Poisoning (MITM)
It responds to LLMNR request = Run it first thing in the morning when doing an internal - This tool will also get you hashes
SMB Relay
Change configuration to OFF at HTTP Server and SMB Server then pass the relay to:
ntlmrelayx.py -tf target.txt