msvctl -- pass the hash action
...pass the hash toolkit . i couldnt get the pass the hash to work on my XP SP1 VM joined to the LSOCORP domain and was too lazy to update it just to play
you can read more on msvctl here
http://truesecurity.se/blogs/murray/default.aspx
it essentially dumps current hashes from memory, you can then take one of those hashes and "pass it" and run...
