Short Summary

utilize a semi colon to execute `cat` and read flag.txt
ping 127.0.0.1;cat flag.txt

The regex here is broken. (You are provided the server code)

/S means any non-whitespace character. So the third octet in your pattern can be letters, punctuation, shell metacharacters, etc

The exploit looks like this:

• ; cat flat.txt