Just simply visit flag.txt in browser. Forgot to add .htaccess in the original problem