I prefer John the Ripper. Used to use crack, but I gave it up. ;)
It's a classic dictionary brute force.
You encrypt the dictionary one word at a time, and compare the hashes. The chance of collision is so small that when you match hashes, you can be sure you've found your password.
Rainbow supports a precomputed has database, which can speed this up immensely... no need to re-encrypt on the fly, you just compare to the DB.
Windows hashes of short passwords (6 chars or less) are especially vulnerable, because the LM Hash is stored in 2 pieces of 8 bytes each (pretty sure it's 8, not worth looking up for the point of this convo). If you use a short password, someone only has to crack half as many bytes. (A 7 byte password is strong, because there are 2 bytes of padding added, making the total stored length 9 bytes.)
Oops!
Actually a collision is also a match. It doesn't matter what the password is just that the hash needs to match. So if you hit a collision you in essence have a working password.