Looking at the network dump and following the first TCP stream:


Looking through the entire dump shows no other service with its version number other than `vsFTPd 2.3.4` so that has to be it. Looking through more streams shows the attackers first command on the server.


So it is `md5(vsFTPd_2.3.4_id)` => `a806fef72a92508b7a64776bb83ad4cb`


Flag: `n00bz{a806fef72a92508b7a64776bb83ad4cb}`