Check the flag05 home directory. You are looking for weak directory permissions
In the flag05 folder are two hidden folders. The .ssh we do not have read permission into. However, the .backup folder we do.
In side the .backup folder is a compressed archive. When we look inside we see a backup copy of the .ssh we couldn’t access earlier.
We extract the contents of the archive into our home folder.
We can now ssh into the machine as flag05 using the .ssh credentials.