Letter Dispair: find the command execution path, trigger it cleanly, and read the flag.