Compromised FTP – Digital Forensics Challenge Writeup | KnightCTF 2022

Used command to get login username from log,

cat a.log |grep 'OK LOGIN'

Mon Jan 3 15:24:13 2022 [pid 5399] [ftpuser] OK LOGIN: Client "::ffff:192.168.1.7"

So the flag is KCTF{ftpuser_192.168.1.7}