LLMNR poisoning
Windows asks the whole local network "does anyone know this name?" when DNS fails, and anybody is allowed to say yes. The first move in nearly every internal penetration test.
When a lookup fails the client falls back to LLMNR over UDP 5355 and NBT-NS over UDP 137, neither of which has any authentication. An attacker on the same segment runs Responder, answers everything, and whoever mistyped a share path happily authenticates to the attacker's machine. The exchange leaves a NetNTLMv2 response that can be cracked offline with hashcat in mode 5600 or — considerably more effective — relayed onward to a real service. The fix is easy and free: disable both protocols by group policy and make sure DNS actually answers. It rarely gets done, which is why the technique still works.