https://iamleandrooooo.github.io/ Recent content on Leandro's Code Cave Hugo en-us Thu, 21 May 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/fireflow_fullpwn/ Thu, 21 May 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/fireflow_fullpwn/ Challenge Description Difficulty: 🟡 Medium Since Full Pwn challenges don’t have a description like other challenges, here’s a recipe for a great Cozido à Portuguesa: Ingredients 500 g beef 1/2 chicken Pork ribs and pork ear 1 chouriço 1 morcela 1 farinheira Potatoes Carrots Cabbage Rice Salt and pepper Instructions Add the beef, chicken, and pork to a large pot with water, salt, and pepper. Boil and simmer for about 1. https://iamleandrooooo.github.io/posts/dudsat_reverse/ Wed, 20 May 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/dudsat_reverse/ Challenge Description Category: Reverse Engineering Difficulty: 🟡 Medium Networks trust its timing. So does a clearing system that moves money across four countries. Six weeks ago someone quietly bought ORBIT-9. Last week the clearing system froze for eleven hours. Yesterday a regional airport logged position drift during a HELIOS-7 pass. Not accidents. Tests. A burned asset codenamed FERRYMAN pulled one file off an ORBIT-9 maintenance laptop before going dark. A binary, lbproc, described internally as a link budget validation tool. https://iamleandrooooo.github.io/posts/sysprobe_reverse/ Wed, 20 May 2026 00:00:00 +0000 https://iamleandrooooo.github.io/posts/sysprobe_reverse/ Challenge Category: Reverse Engineering Difficulty: 🔴 Hard Task Force Nightfall has intercepted a binary pulled from a compromised monitoring node inside a critical infrastructure operator. On the surface it is exactly what it claims to be - a routine diagnostics utility, the kind deployed silently across thousands of managed endpoints. Clean signature, legitimate-looking output, nothing that trips an alert. But the node it was found on had no business running it. https://iamleandrooooo.github.io/posts/sandy/ Fri, 03 Oct 2025 00:00:00 +0000 https://iamleandrooooo.github.io/posts/sandy/ Challenge Description Author: John Hammond My friend Sandy is really into cryptocurrencies! She’s been trying to get me into it too, so she showed me a lot of Chrome extensions I could add to manage my wallets. Once I got everything sent up, she gave me this cool program! She says it adds better protection so my wallets can’t get messed with by hackers. Sandy wouldn’t lie to me, would she…? https://iamleandrooooo.github.io/about/ Sat, 13 Sep 2025 00:00:00 +0000 https://iamleandrooooo.github.io/about/ Hey, I’m Leandro! I am an Offensive Security Specialist, and spend my days hunting down security flaws, tinkering with code, and figuring out how systems can break. I’ve collected a few certifications along the way (OSCE3, OSWE, OSED, OSEP, OSCP, OSWP, CRTP, GCIH, etc.), and a few CVEs: CVE-2025-28168 CVE-2026-26273 CVE-2026-26281 CVE-2026-26270 CVE-2026-40888 I actually started in software engineering, so I know my way around development, and architecture before diving headfirst into security. https://iamleandrooooo.github.io/posts/rc4_reverse/ Sat, 13 Sep 2025 00:00:00 +0000 https://iamleandrooooo.github.io/posts/rc4_reverse/ RC4 Reverse Engineering RC4 Overview RC4 is a lightweight stream cipher commonly used in malware for string decryption, binary unpacking, and encrypting network traffic. When analyzing a binary that uses RC4, there are a few key indicators and areas worth examining. No matter how much obfuscation is applied, typically if you find two loops responsible for initializing and scrambling a substitution box, it’s a strong sign that RC4 is being used. https://iamleandrooooo.github.io/posts/verificationclarification/ Sat, 13 Sep 2025 00:00:00 +0000 https://iamleandrooooo.github.io/posts/verificationclarification/ Challenge Description Author: @resume Difficulty: 🟡 Medium One of our users received an unexpected email asking them to complete extra verification in order to download a zip file, but they weren’t expecting to receive any files. Your task is to investigate the verification link provided in the email and determine if it’s suspicious or potentially malicious (“phishy”). Note: If the verification link doesn’t respond when you visit it directly, try accessing it using a different method or tool. https://iamleandrooooo.github.io/posts/sqlserverlinkedserverspasswords/ Fri, 12 Sep 2025 00:00:00 +0000 https://iamleandrooooo.github.io/posts/sqlserverlinkedserverspasswords/ SQL Server Linked Server Passwords ⚠️ Disclaimer: Legal Use Only This script is provided solely for legal purposes. Any use of this script for illegal activities or in violation of applicable laws is strictly prohibited. I take no responsibility if: You use this script for unlawful purposes. You encounter any legal consequences as a result of using this script inappropriately. This whole script can be broken down into 4 steps. The first step is enabling TCP/IP connections on all SQL Server Instances.