[Black Agnes]

Which makes me wonder again. Why ask for the hash files if they can just get the passwords the old fashioned way?

[Myrddin]

If you get the hash files, then you can use the rainbow tables to map a plain text ASCII password that will produce the hash. At that point, you have access to the account with the password through the front door. You get all the privileges accorded via the authentication and authorization applied to that user. Cookies and sessions work via the web interfaces. If you're really brazen, you can also change the password as most systems require presentation of the old password in the process of creating a new one.