Stack-based Buffer Overflow in Tenda A15 /cgi-bin/UploadCfg UploadCfg

This repository is a small proof-of-concept demonstrating a timing side-channel against a simulated Kyber KEM decapsulation routine. It contains two code files: kyber_vuln_decaps.c, which implements a deliberately vulnerable decapsulation function, and timing_attack.py, which loads the compiled shared library and measures execution time to recover secret-dependent comparison state. The C code hardcodes a 16-byte secret_key and computes a derived re_enc buffer as secret_key XOR 0x55. The vulnerability is the byte-by-byte comparison loop in vulnerable_decaps that returns immediately on the first mismatch, creating measurable timing differences based on how many leading bytes of attacker-controlled ciphertext match the internal re_enc value. If all bytes match, the function copies the secret key to the output buffer. The Python script uses ctypes to load ./kyber_vuln.so, repeatedly invokes vulnerable_decaps with crafted 16-byte ciphertext guesses, and records nanosecond timing via time.perf_counter_ns(). For each byte position, it tries all 256 values and selects the one with the longest execution time, assuming that a correct guess advances the comparison further before early exit. After recovering all 16 bytes of the internal re_enc value, it derives the secret key by XORing each recovered byte with 0x55 and prints the recovered key. Repository structure is minimal: LICENSE, README.md, the vulnerable C source, and the Python attack script. There are no remote network targets, C2 endpoints, or persistence mechanisms. The exploit capability is local side-channel key recovery against a demonstrative vulnerable library, though the README frames it as analogous to a real-world Kyber decapsulation timing flaw. The code is best classified as a POC exploit rather than a detection script, because it actively performs secret recovery rather than merely checking for vulnerability presence.