Analysis of a SonicWall SMA1000 exploitation toolkit: refactored Rapid7 PoC, LDAP decryptor, appliance-hosted Impacket

The operator's full toolset was recovered from an open directory, so there is a fair bit to pick through. The exploit (cve-2026-15409-exploit.py) is a direct refactor of Rapid7's public PoC, still crediting Ryan Emmons in the header, reworked for repeatable unattended use. A separate check script (cve-2026-15409-check.py) handled detection-only...