Note: I realize there is no legally binding talk hereinafter.
There are lots of leaked password hashes on the internet. Twitter searches for "hash dump" pull back tons of links, generally from "deep web" servers. As security yokels, we find it interesting to see how secure (or insecure) these dumps are; many are from reputable entities. To that end, it would be fun, interesting, and provide good experience to crack some of these dumps.
A court had previously found a man guilty, as Thomas pointed out in this answer, for simply running a password cracker, but this was expunged (as if he never did anything wrong). In addition, gimmiky articles have journalists writing about how they've cracked passwords.. I doubt they'd be shouting it if it were illegal.
So, is there any legal risk at visiting one of these "dump servers", downloading the hashdump, and cracking passwords? At what point do you metaphorically "cross the rubicon"?
Obviously, using any cracked passwords would just be rude.