Hikvision camera admin password reset tool

LaZona

Young grasshopper
Joined
Jan 26, 2017
Messages
41
Reaction score
5
If you need to reset your password, let me know I can help.
 

LaZona

Young grasshopper
Joined
Jan 26, 2017
Messages
41
Reaction score
5
It was already shared here a few days ago, but someone deleted the post.
 
Joined
Aug 31, 2017
Messages
1
Reaction score
0
Location
Bahawalpur
DS-7108HGHI-E10820150511AAWR518199674WCVU
showing date as
2012-10-03
using latest sadp tool.
tried every possible password. but it says. device rejected.
 

catseyenu

Getting the hang of it
Joined
Jun 13, 2014
Messages
324
Reaction score
42
It was already shared here a few days ago, but someone deleted the post.
Did it look anything like this?
Hikvision camera admin password reset tool

HTML:
<html>
<head>
    <title>Hikvision Password Reset</title>
    <script type="text/javascript">
        function padLeft(str, l, c) { str = str + ""; return Array(l - str.length + 1).join(c || " ") + str }
        function initialize()
        {
            document.getElementById("year").value = new Date().getYear() + 1900;
            document.getElementById("month").value = padLeft(new Date().getMonth() + 1, 2, '0');
            document.getElementById("day").value = padLeft(new Date().getDate(), 2, '0');

            document.getElementById("serialNumber").onchange = GenerateSerialCode;
            document.getElementById("year").onchange = GenerateSerialCode;
            document.getElementById("month").onchange = GenerateSerialCode;
            document.getElementById("day").onchange = GenerateSerialCode;
        }
        function GenerateSerialCode()
        {
            var serialNumber = document.getElementById("serialNumber").value;
            var year = document.getElementById("year").value;
            var month = document.getElementById("month").value;
            var day = document.getElementById("day").value;
            var plainText = serialNumber + year + month + day;

            var magicNumber = 0;
            for (var i = 0; i < plainText.length; i++)
                magicNumber += (plainText.charCodeAt(i) * (i + 1)) ^ (i + 1);

            magicNumber *= 1751873395;
            magicNumber = magicNumber >>> 0; // convert to 32 bit integer

            var magicWord = magicNumber + "";
            var serialCode = "";
            for (var i = 0; i < magicWord.length; i++)
            {
                var c = magicWord.charCodeAt(i);
                if (c < 51)
                    serialCode += String.fromCharCode(c + 33);
                else if (c < 53)
                    serialCode += String.fromCharCode(c + 62);
                else if (c < 55)
                    serialCode += String.fromCharCode(c + 47);
                else if (c < 57)
                    serialCode += String.fromCharCode(c + 66);
                else
                    serialCode += String.fromCharCode(c);
            }

            document.getElementById("output").innerHTML = serialCode;
        }
        window.onload = initialize;
    </script>
    <style type="text/css">
        body
        {
            width: 450px;
        }
        .description
        {
            margin: 20px 0px;
        }
        .label
        {
            margin: 10px 0px;
        }
        .input
        {
            margin-bottom: 10px;
        }
        #output
        {
            font-weight: bold;
            border: 1px solid black;
            padding: 10px;
            font-size: 2em;
            max-width: 100%;
        }
    </style>
</head>
<body>
    <div><h2>Hikvision Camera Password Reset Utility</h2></div>
    <div class="description">This tool will generate a <b>password reset code</b> which you may use to reset a forgotten admin password for a Hikvision camera.</div>
    <div class="label">Enter your camera's complete CASE SENSITIVE serial number, as seen in the <a href="Hikvision SADP - Google Search">Hikvision SADP</a> tool:</div>
    <div class="input"><input type="text" id="serialNumber" style="width: 100%" placeholder="Hikvision Camera Serial Number" /></div>
    <div class="label"><b>Important:</b> The date you enter below much match with the camera's clock. <b>Most likely it is not today's date!</b> To find out what date your camera thinks it is, power cycle your camera, give it time to boot up, and then refresh your camera list in SADP and check the Start Time column.</div>
    <div class="label">Enter the <b>4 digit</b> year the camera thinks it is:</div>
    <div class="input"><input type="text" id="year" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> month the camera thinks it is:</div>
    <div class="input"><input type="text" id="month" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> day the camera thinks it is:</div>
    <div class="input"><input type="text" id="day" style="width: 20%" /></div>
    <div class="label">Your <b>password reset code</b> will appear below.</div>
    <div id="output"></div>
    <div class="label">The code must be entered into the <a href="Hikvision SADP - Google Search">Hikvision SADP</a> tool in the <b>Serial code</b> box (called <b>Security Code</b> in later SADP versions). The camera will compare its internal date and time with the date and time you have entered above. The Serial Number and date much match perfectly or else the code will not work.</div>
</body>
</html>
 
Last edited:

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,005
Location
USA
Haha. I do recall, within the past week or so, deleting a user who had just signed up to drive traffic to his site where he had hosted this or a similar tool that offered the same reset method. Not something to deal with the new and more secure method from newer firmwares.
 

sdyfgasd

n3wb
Joined
Jun 13, 2017
Messages
18
Reaction score
2
I have a rebranded NVR DS-7616NI-E2/8P. After flashing firmware, all my user accounts got corrupted. I can access as admin via GUI on the device without authenticating (just cancel on prompt and get full access). However, web or IVMS doesn't authenticate with the credentials I've created before the flash. Attached is the screenshot of the user menu on the DVR:


Likewise, I cannot change the password for the admin, as the old password isn't accepted. Very screwy. Firmware is 3.4.62 build 160713.
The NVR refuses telnet and SSH.
Master reset steps do get me to the "enter code" scree. However, I can't get Hikvision support. Can this be reset?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
There have been some posts a while back with the same symptoms, and the way to get round it.
I have a vague recollection it involves going through the list of garbled logon IDs in the web GUI until you find one that works, I think it was with the previous password. I'm not sure what the steps were after that - reset back to defaults, or try changing a password.
I've done a few searches but failed to find the posts I was thinking of.
Perhaps another member will have more info.
 

sdyfgasd

n3wb
Joined
Jun 13, 2017
Messages
18
Reaction score
2
I've been able to get a reset code from the seller, and have successfully reset the admin password. The user name is still screwed up, however. It's a selection menu in the GUI, so I don't have to type the username in, just the password. Remotely/web/IVMS cannot access as admin because the admin username is not actually "admin." What a pain.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
And if you do a tftp update with the same firmware that you flashed that didn't correctly translate the configuration file, the result will be configuration reset to defaults.
 

katumba1

n3wb
Joined
Sep 8, 2017
Messages
1
Reaction score
0
Louiseliu007 can you please help w/ password on this camera? Hik support won't help me as i bought it on ebay. I've tried the online tool here numerous times and it won't reset it.

HAR314-80820161112CCWR673124813WCVU

3.4.75 build 160926

date: 2017 07 22

DSP: v5.0

would hate to just have to trash it
 

nlagaros

n3wb
Joined
Oct 12, 2015
Messages
14
Reaction score
1
I found a script that will generate the recovery code for cameras with 5.3 or higher firmware.
Can you share the script with me? I have a cam with 5.4 firmware that I need to reset the password on. Thanks.
 

sdyfgasd

n3wb
Joined
Jun 13, 2017
Messages
18
Reaction score
2
I've just published a new reset tool that exploits this vulnerabilityto achieve the reset. It should work on firmwares that are too new to use the old reset code method, but old enough to not have this backdoor patched yet.

I've edited the first post of this thread with details and the download link.
Does your tool recreate an account or just resets the password for an existing one? What do you think it will do for my NVR (Hikvision camera admin password reset tool), assuming the vulnerability is present?
 

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,005
Location
USA
Does your tool recreate an account or just resets the password for an existing one? What do you think it will do for my NVR (Hikvision camera admin password reset tool), assuming the vulnerability is present?
It calls the command that modifies a user, sending a new password. Worth a try on your NVR. I can't see it breaking anything. If it doesn't work as intended then it will just error-out at the "Get Users" stage.
 

RyanODan

IPCT Vendor
Joined
Mar 10, 2014
Messages
626
Reaction score
266
Location
Tulsa
I've just published a new reset tool that exploits this vulnerabilityto achieve the reset. It should work on firmwares that are too new to use the old reset code method, but old enough to not have this backdoor patched yet.

I've edited the first post of this thread with details and the download link.
v5.4.0 160401 - Working

v5.4.0 160520 - Working

v5.4.3 160705 - Working

v5.4.4 161125 - Working

Honestly @bp2008, you've done it again. I can't thank you enough for releasing this. Days of headache and wasted time waiting on password resets. Almost everything before v5.4.5 should reset since it's based off the exploit. I've only came across a few that haven't yet.
 
Last edited:

bp2008

Staff member
Joined
Mar 10, 2014
Messages
12,666
Reaction score
14,005
Location
USA
I'm glad to help. Thanks for the list of verified firmware versions. I've added them to the readme on github.
 
Top