Is it possible to perform a MITM Attack through a compromised Windows Machine in a internal LAN? How would be the attacker's scenario? How to do this?
From a meterpreter session you could run post modules that run on the compromised machine.
You could also use port forwarding in the case you want to connect to Remote Desktop and the port itself isn't accessible from the attacker's machine.
Tools like nighthawk can be used to achieve ARP spoofing (MITM).
It all depends on how stealthy you need to be. Note this is a brief overview and I haven't gone into any depth on these items as your question seems very broad. Feel free to ask a new question covering only a specific item, then link back to this as reference.