If you follow the same logic in getting the username to get the password, you will fail. The eventual password, when you dump it, won’t work because <reasons>. The challenge asks you to use the username:password for the flag and while the challenge uses the actual username, it doesn’t use the actual password in the flag. You’re just expected to try bits and pieces until you come up with the piece the author submitted as the flag and not the actual password the program uses at the end.
Waste of time. This doesn’t teach you anything other than throwing #!7$ at the wall until something finally sticks. If you like trolls, great. Personally I come here to learn, not get trolled by bored authors. To each their own though.