First of all: the salted hash generally contains only the password, not the username, but they are commonly nearly stored.
He will then be able to launch an offline Brute force attack, trying to find the password that generates that same hash using that same salt.
This attempt may be dictionary-based or exhaustion search-based.
Also, to be allowed access, one MUST have possession of at least 3 pieces of information:
- Address (in this case, FTP's address)
If he already has the ftp address and the password, he still has to discover the username. It is possible to use the same technique to make several attempts until he finds a username that uses the known password in its credential.
The usage of SALTING only prevents other accounts with the same password from having the same hash, what would promptly alert the hacker about users sharing the same password.