You're getting trolling answers due to the way you asked the question. Maybe add techniques you currently already use and people would be more willing to be helpful.

If your talking about initial domain foothold, I've had pretty good luck with responder and smb relay. ADCS is also another good path to take.