first flag in hidden directory .config

get barry’s bash_history and password…we get 2nd flag

i_l0ve_s3cur1ty! : barry pass

in /var/log/flag3.txt

then in apache tomcat we get the next creds

T0mc@t_s3cret_p@ss!