SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475)

Now we’ve demonstrated that we can read arbitrary files from a vulnerable SonicWall SMA appliance - or specifically, arbitrary files that the webserver can read (the webserver runs as the nobody user) - it’s time to escalate our access and use this vulnerability for something meaningful. __int64 traceroute6_handler(FILE *stream, char *initial_command) // [1] { __int64 initial_command_dup; // rax const char *v3; // rax FILE *v4; // r14 int v5; // r12d const char *v6; // rax const char *v8; // rax const char *v9; // rax _BYTE escaped_cmd[256]; // [rsp+0h] [rbp-1F48h] BYREF char command[512]; // [rsp+100h] [rbp-1E48h] BYREF char v12[1040]; // [rsp+300h] [rbp-1C48h] BYREF char s[6152]; // [rsp+710h] [rbp-1838h] BYREF unsigned __int64 v14; // [rsp+1F18h] [rbp-30h] v14 = __readfsqword(0x28u);…