# Day 02

Open the provided pcap, we can find many ftp connections. Grep for `PASV` leads to a valid login:

[![](<https://jia.je/ctf-writeups/2025-12-02-advent-of-ctf-2025/day-02.png>)](<https://jia.je/ctf-writeups/2025-12-02-advent-of-ctf-2025/day-02.png>)

Therefore the compromised account is found.