This is pretty slick from the Attack Research site. You can use Meterpreter plus a memory dumping tool to remotely dump memory and pull passwd hashes from it. I see Bejtlich also posted about this. Part 1 and Part 2