I got that question on an exercise and I'm not sure what to answer.
Without conventional brute-forcing and without a rainbow table, how could I find out the password?
An improved brute-force algorithm is acceptable, but how could I improve it?
Assuming a decent hash function, the only way to find the password in this situation is to guess it. This is true for any cryptographic hash function: it's the meaning of the preimage resistance property. This is true for any cryptographic hash; password hash functions have additional properties (salt and slowness) that make it more expensive to verify guesses.
Rainbow tables work by precomputing the hash of many passwords and storing them in a way that allows quickly finding the password from the hash if the password is in the precomputed set. In other words, you make a lot of guesses in advance.
“Conventional brute-forcing” is an ambiguous term. It may refer to trying passwords in a naive order (e.g. by increasing length). But you're free to make guesses in any order. For example, it makes sense to try
You cannot find the password in any other way by computational means, but you may be able to find it by external means, such as: