I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through rainbow tables.
I was able to crack some credentials due to the password being the same as the username, however I have been unable to use these credentials to get anywhere. RDP is locked down to only specific users and I have not been able to connect to any machine via psexec (access denied).
Passing the hash does not work with NTLMv2 so I fear I may be out of options, but would like to get suggestions for anything else I could try. I have a number of NTLMv2 hashes and a few valid user credentials.