Welcome to Security.SE.
First, a brief explanation of hashing versus encryption, because that's important here.
Hashing and encryption
When talking about hashes, it is impossible to decrypt. Hashes are one-way and cannot be reversed to retrieve the plaintext. This matters because how you go about getting the plaintext is very different from encryption and hashing.
Finding the plaintext of a hash
John the Ripper and hashcat are both tools that can be used to find the plaintext of a hash. However, throwing a wordlist at them isn't always the most effective way to use those tools. You need to know a few things about the target, in addition to the algorithm used. You know you have a MySQL 5 hash, but here's some other things that will help you:
- Is there a password policy? (minimum x characters, upper, lower, symbols, etc.)
- If the administrator chose a common password, it may be in password lists. If the administrator did not, you may have to do additional reconnaissance to build a wordlist that is more directed at the user.
Is there another way besides brute forcing?
Short of a weakness in the algorithm itself, no. Hashes in general are intended to be resistant to attacks against the algorithm. While tools like John and Hashcat do try to make performance improvements against a particular algorithm given its properties, brute forcing, with keeping in mind what I mentioned above, is how hashes, MySQL hashes or otherwise, are attacked.
However, if you pulled a hash from a database in the challenge, that's different from pulling the MySQL user hash. That is, storing website users in a database doesn't necessarily use the MySQL hashing algorithm. It can be something else like MD5 or SHA1.