“(…) account credentials came from a legacy unix system” mhm:
$ cat /etc/passwd
(...)
flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh
(...)
Ah, good old DES:
$ echo ueqwOCnSGdsuM > flag06.des
$ ./john flag06.des
Loaded 1 password hash (Traditional DES [128/128 BS AVX-16])
hello (?)
?:hello
thus:
$ su flag06
sh-4.2$ getflag
You have successfully executed getflag on a target account
Nice one.