When Super Mario looks at your average network topology diagram he sees opportunity in those bricks and adventure in those pipes! Join Mario as we target the Cisco ASA firewall on our way to rescue Princess Peach from Bowser's Castle. Chaining no less than three previously unknown exploits we will remotely compromise the perimeter Cisco ASA firewall. Then, using the firewall's built-in NAT functionality we will explore the possibility of moving laterally while evading anomaly and flow analytics based network intrusion detection. This talk will explore the inner workings of the Cisco ASA appliance and present opportunities for further exploit development and the placement of reboot persistent rootkits. This presentation will have you question the security of your network security devices and leave you asking if we should hold security vendors to a higher standard.