HTB: Cap

First public writeup: IDOR in a security dashboard leaks an FTP capture with credentials, then a python capability flips the box.