Use the Netlogon Remote Protocol (MS-NRPC) to dump the target hash. - View it on GitHub