Overview
Having spawned a shell as user2, we look for paths to access the user3 user home directory.
Reconnaissance
Checking the directory permissions on /home/user3, we find it is readable by members of the group devs:
drwxr-x--- user3 devs /home/user3Exploitation Strategy
Although we are user2, our current active group ID does not match. We use the command newgrp devs to switch our group context to devs, which immediately permits us to enter /home/user3 and retrieve flag 5.
Solution Code
newgrp devs
cd /home/user3
cat flag5.txtFlag
Dynamic Flag (User 3 devs flag)