Bought a box of used hikvision cameras

dompel

n3wb
Joined
Dec 3, 2022
Messages
12
Reaction score
16
Location
USA
Hi guys,

I bought a box of used hikvision cameras. I have, I think like 14? All different models. I was going to go through the box and try to gain access to them and update the firmware. I bought these from a wholesaler who bought them from some place that did leases. I don't know the passwords and I don't see any reset buttons and I'm not sure how to proceed.

I tried the SADP tool and the cameras show up but the default password I found online (123456, and 12345) don't seem to work. I stumbled upon Hikvision Password Reset Tool but I don't think that will help me here. The SADP tool doesn't show the code box (only a file upload) for resetting. Also, at least on the first camera I'm looking at the FW is v5.4.0 which may not work with that exploit.

I have an NVR but I haven't used the plug and play features of it. Is there some way to reset it through that?

Any advice would be appreciated!
 

TonyR

IPCT Contributor
Joined
Jul 15, 2014
Messages
16,972
Reaction score
39,476
Location
Alabama
I only have 1 Hikvision so I'm not much help but if you insisted on my help this is where I'd start:
Take one at a time and Google the model number, find the manual and see if there's a reset button.
If you can find one and perform a hard reset then usually the default IP to log into the cam's embedded webGUI with a browser is either 192.168.0.64 or 192.168.1.64 ( I can't recall which).
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,976
Reaction score
6,800
Location
Scotland
Also, at least on the first camera I'm looking at the FW is v5.4.0 which may not work with that exploit.
For firmware of 5.4.0 or earlier, for most models, there is a Hikvision backdoor vulnerability that can be used to extract the camera admin password.

Suggestion to try :
Power the camera, use SADP to see the camera IP address.
Set the PC IP address to be in the same range as used by the camera.
Pull a copy of the configuration file with a browser (ideally IE but should work with others) using this URL:

http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK

Zip the file and attach here and it can be decrypted and decoded to reveal the admin password.
 

dompel

n3wb
Joined
Dec 3, 2022
Messages
12
Reaction score
16
Location
USA
So most of these look like they are running 5.4.5 which seems like the URL to get configuration file requires a password. The above one was running 5.4.0. Here's one I found that's running an even older 5.3.0 in case that helps.

I'm really hoping that all of these share the same admin PW so if I can figure out one I can get into them all.
 

Attachments

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,976
Reaction score
6,800
Location
Scotland
Thanks a ton! I had to do some networking magic to get this accessible but I finally got it.
Well done!

The extracted passwords for admin, in the order of your posts, are :
0$Tech123
0$Tech123
0$Tech123

I'm really hoping that all of these share the same admin PW so if I can figure out one I can get into them all.
You may well be in luck!

Pulling passwords is always a fun activity ...
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,976
Reaction score
6,800
Location
Scotland
I have an NVR but I haven't used the plug and play features of it.
Given that the cameras are compatible with your NVR (what model is it?) probably the easiest way to add the cameras is to reset the cameras to factory defaults (ie Inactive), which can be done via the camera's Maintenance menu in the its GUI, and simply plug them into the NVR PoE ports.
If the NVR PoE ports are in Plug&Play mode, the NVR will Activate the camera, configure settings and establish a connection.
 

dompel

n3wb
Joined
Dec 3, 2022
Messages
12
Reaction score
16
Location
USA
You rock, man! I got in. Now I can work through my box and see which ones are still good and update them all.

My NVR is a DS-7608NI-I2 but I've always just used another PoE switch to power my cameras and set them up manually. Good to know with the admin password I can more easily reset them to factory with the NVR.

Thanks again.
 

wittaj

IPCT Contributor
Joined
Apr 28, 2019
Messages
25,304
Reaction score
49,292
Location
USA
Just keep in mind updating them brings a whole new set of risks LOL....would hate to get them working just to brick them LOL.. I'd suggest if they work, leave them alone!

Also keep in mind you can only add as many cameras as your NVR is rated for. So it will only accept 8 cameras regardless of whether they are connected to the POE of the NVR or external switches.

A common theme around here is don't fix what ain't broke. If the unit is working and meets your needs, in many instances an update breaks what you had working and provides you with something you didn't need or bricks the camera. In most instances, updates are simply security vulnerability patches (usually years after the breach was found), but since we do not give our cameras internet access, the update is useless to us.

Unless the release notes specifically mention it fixing a problem you are experiencing, more than likely it won't fix an issue and may make the camera worse by removing functionality.

I am not sure about that camera firmware, but Hikvision has been preventing some firmware from being downgraded, so if it removes something you want, you will be out luck.

Here are issues I have seen people report here where they were upgrading just for the sake of upgrading:
  • A Dahua Z12E that someone updated and then constantly reboots comes to mind.
  • The Dahua 49225 and 49425 PTZ that loses autotracking with an update come to mind.
  • The Hikvision DS-2DEA425IW-DW PTZ that loses autotracking with an update comes to mind.
  • A Hikvision ANPR camera losing half the FPS and loses the ability to read US plates - those are big deals to have happen.
  • A Hikvision ANPR DS-2CD4A26FWD camera that lost all ability to read plates - kinda makes the camera useless.
  • A Hikvision camera that the user lost ability to control the LED light function at night.
  • Hikvision DS-7616NI-Q2 NVR that has the APIs changed.
  • A Hikvision wifi camera that loses the ability to use wifi after a firmware update.
  • DH-DB61 Doorbell that loses API functionality.
  • Hikvision iVM4200 v3.8 - loses the free ability to use the computer as storage.
  • Dahua IPC-HFW1320S that started phoning home using 60MB/hr and costing someone thousands of dollars in data overages.
  • Dahua 5442 that will not allow playback of the SD card.
  • Countless other instances where the camera or NVR simply bricked and became useless.
  • Countless examples where the camera or NVR went into Chinese.
Don't do it unless it is fixing a problem you are experiencing or adds a feature you really need.

Another thing to consider is that the same model could have different firmware for different chipsets used during the life of that model. So you run the risk of bricking if you do not know what chipset you have.

Here is an example - the HFW3549T1-AS-PV is available in 2 versions of firmware across 3 different chipsets for the same model camera:
  • HFW3549T1-AS-PV-S4 uses the HX3XXX-Taurus firmware.
  • HFW3549T1-AS-PV and IPC-HFW3549T1-AS-PV-S3 use the HX5XXX-Volt firmware
In this instance, Dahua added an S# designation after the model number (while Hikvision adds a C), but many do not and then you try to update with a firmware not compatible with your chipset and potentially brick it.


Further, it is best to obtain any firmware updates from the vendor you purchased it from so that you do not run into issues. Any firmware you find here or elsewhere is obviously proceed at your own risk. We have many threads here where someone tried an update with a firmware they found on the internet and bricked their unit.

Many units being sold are Chinese hacked units into English that will either brick or go into Chinese upon updating. Some vendors will be upfront and tell consumers that as part of their website, but many do not or the consumer forgets...here is one such example....

1670166837316.png
 

dompel

n3wb
Joined
Dec 3, 2022
Messages
12
Reaction score
16
Location
USA
OK, so no PoE ports on the NVR, so that part of Plug&Play activation doesn't feature.
I think the ports on the back of the NVR are PoE, even though I haven't used them. I saw a camera's IR LEDs light up yesterday when I was using them while I was debugging.

Thanks @wittaj you made some good points! I'll keep that in mind.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,976
Reaction score
6,800
Location
Scotland
Just keep in mind updating them brings a whole new set of risks LOL
Yes indeed, it can do. Especially for those less familiar with the technology.

But as we've seen, these particular DS-2CD2332 cameras are running on very old, very vulnerable and easily compromised firmware with many more bugs and fewer features than in the most current firmware.
 

wittaj

IPCT Contributor
Joined
Apr 28, 2019
Messages
25,304
Reaction score
49,292
Location
USA
I think the ports on the back of the NVR are PoE, even though I haven't used them. I saw a camera's IR LEDs light up yesterday when I was using them while I was debugging.

Thanks @wittaj you made some good points! I'll keep that in mind.
Depending on the NVR, if you were using the back of the ports for debugging, it may have "assigned" the camera to that port, so you may need to confirm that none of your channels have now been allocated to a specific camera.

We see people come here that bought say an 8 channel NVR and hooked all the cameras up to bench test them and then went and installed them all around the house and then couldn't see any of the cameras because they were not plugged into the same port.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,976
Reaction score
6,800
Location
Scotland
Thanks @@wittaj you made some good points! I'll keep that in mind.
The points made are valid, it is necessary to be aware of them.

One thing to check, take a look at the serial numbers (SADP and the label) and make sure they are not CN cameras by confirming the letters CCCH don't show in it.
 

dompel

n3wb
Joined
Dec 3, 2022
Messages
12
Reaction score
16
Location
USA
The points made are valid, it is necessary to be aware of them.

One thing to check, take a look at the serial numbers (SADP and the label) and make sure they are not CN cameras by confirming the letters CCCH don't show in it.
Will do.

I found a few cameras that have different passwords. One is 5.4.5 so I guess there's nothing we can do. This one attached is 5.3.0, mind grabbing me this PW too?
 

Attachments

dompel

n3wb
Joined
Dec 3, 2022
Messages
12
Reaction score
16
Location
USA
Overall, here's my haul:

Working cameras
- 7 x DS-2CD2332-I Dome
- 1 x DS-2CD2032-I Bullet
- 1 x DS-2CD2112F-J 4mm Dome
- 1 x DS-2CD2232-I5 Bullet

NFG cameras (don't show up in SADP tool)
- 1 x DS-2CD2232-I5 Bullet
- 1 x DS-2CD2632F-I (2.8-12mm) (PoE not working I think, got it booted once with PSU)

Working but don't know password
- 2 x DS-2CD2232-I5 Bullet

I paid $200 for the lot. I was hoping to get like $20 per usable camera. I'd consider like 8 or 9 of these usable so I'm pretty close to that. Not sure if this is a good deal or a bad deal but it is what it is now. Really glad I found this forum and got some help unlocking these. Because it would have been a much worse deal if I couldn't use any of them :lmao:.

I'm going to resell some of the working ones locally because I don't need this many. If anyone has any interest in the broken ones for parts or something let me know. Anything I can do to keep electronics out of the trash is a good thing IMO.
 

wittaj

IPCT Contributor
Joined
Apr 28, 2019
Messages
25,304
Reaction score
49,292
Location
USA
Yeah if reselling them, don't update it LOL. Let the next person that buys it deal with that LOL
 
Top