Basically, to give the short story:
The Serbians knew what time the F-117s flew and the route they would take (the US didn't bother changing this as they knew the Serbians didn't have the ability to shoot down an F-117), they also knew that no other planes would be out flying SEAD or interdictor missions, etc (the US didn't bother supporting the bombers as they knew the Serbians didn't have the ability to shoot down an F-117). This meant they basically had free reign to try and find one.
So Ivan (I don't recall his name, I'm going with Ivan, if that offends the posters from Moscow so be it) tuned his radars to what he thought would work, waited, then at the right time turned them on and nothing, he turned them off waited and on again, nothing. On any other night he would now be frantically rushing to relocate before he got obliterated but he knew no SEAD planes would be out an so rolled the dice and tried again, *ping*. The rest is history.
What isn't often mentioned though is that the F-117 has a computer controlled bomb release. The target is pre-dialled in and the pilot just flies, when it's time to bomb the computer will open the door, drop the bomb, close the door. Ivan pressed his button during the only 0.5 second window of the entire flight when the door was open and the radar signature expanded long enough for him to get a lock. Put simply the odds of winning the lottery jackpot two weeks in a row are easier than hitting that F-117 was, that's how lucky he got.
Another thing not mentioned often is that the F-117s were out again the next night (though this time with actual support), Ivan never hit another, he never dared try.
This is where they myth that Russian SAMs can defend against the F-22 and F-35 comes from, and it's a myth that has sold a lot of SAMs since 1999. They can't, even the S-500 can't detect them before they are well within range to kill it. Ivan just got crazy lucky.