Hoping against hope that the webmaster hadn't changed the default password, which is often just 'password', he entered 'password' as the ftp password.
It worked, and Tomble managed to break into the server.