Recommendation needed for SMB relay / Pass the hash attacks

As @VbScrub mentioned, doing the actual PTH is pretty simple. Getting there is most of the battle. If you want to do it yourself, try the Forest machine. It teaches some good Windows concepts in addition to PTH.