NTLM relay
The attack where you don't crack the authentication, you forward it — the victim logs in to the attacker, who passes the same login on to a real server.
NTLM proves identity with a challenge and a response, but never proves who the response was meant for. An attacker who gets a client to authenticate to them can therefore open a connection to a file server or a domain controller, forward the challenge, let the client answer, and be admitted as that user. No password is cracked and no hash even needs to be known. The tool is in practice always ntlmrelayx from Impacket, paired with something that coerces the authentication in the first place. The defences are SMB signing, LDAP signing with channel binding, and Extended Protection for Authentication — all three switched off in far too many domains.