Looking at the network dump and following the first TCP stream:
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/7385c750-3286-4083-b8c3-53302286314e)
Looking through the entire dump shows no other service with its version number other than `vsFTPd 2.3.4` so that has to be it. Looking through more streams shows the attackers first command on the server.
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/32885562-a8d5-49cb-832d-74159857eda5)
So it is `md5(vsFTPd_2.3.4_id)` => `a806fef72a92508b7a64776bb83ad4cb`
![image](https://github.com/jeromepalayoor/ctf-archive-hub/assets/63996033/c0eb6adf-2c19-4350-bbc0-bb235328bec5)
Flag: `n00bz{a806fef72a92508b7a64776bb83ad4cb}`