An attacker accesses a server using reused NTLM hashes without cracking passwords.

The correct answer is D, Pass-the-hash. In a pass-the-hash attack, the attacker does not need to crack or know the plaintext password. Instead, the attacker reuses a captured or extracted NTLM hash as an authentication credential to access another Windows system or server. CEH system hacking and password attack material describes this concept directly: the attacker steals the hash and sends it instead of cracking the password, allowing Windows authentication to treat the hash as valid credentials. CEH password attack material also describes hash injection, where extracted logon hashes from SAM or memory are used to log on to other servers and exploit more accounts. Brute force attempts many password guesses, Kerberoasting targets Kerberos service tickets, and replay is a broader category but not as precise here. Because the question specifically mentions reused NTLM hashes without cracking passwords, the exact attack is pass-the-hash.