I'm experimenting with ways to harvest NTLMv2 hashes remotely. Responder.py is perhaps the most widely used mechanism (these days) to perform the task, but I'm unsure if it's even possible to utilize it remotely.
Ideally what I'd like to do is run Responder on my attacking box and proxy the information through a compromised machine via a Meterpreter shell (or similar mechanism).
Is this something that's possible? I've been able to find no real documentation on it.
If not, is there a mechanism that could accomplish this that does not involve privilege escalation to harvest passwords from lsass?