2CD1131 IP Whitelist Issue

[feganmeister]

So I think I've managed to block myself from accessing my camera

Rather stupidly, I set the IP whitelist to 192.168.0.0 thinking it would allow all IPs on that subnet. Now, although I can see it in SADP, I can't connect via HTTP or RTSP. I set the camera IP to 192.168.0.2 via SADP then got an Ubuntu 16 device and set the IP to 192.168.0.0. Once I connected them (via cross-over cable) I could ping the camera and do a simple port scan (TCP 22, 80, 554, and 8000 open). However, I still can't connect to the camera from the browser. Any ideas what to try next?

The only other option I can think of is flashing the firmware and using the Hikvision Firmware Tools to set the language back to English. I can't find the firmware for this model though, so any help there would be appreciated too.

Thanks!

 

[alastairstevenson]

A couple of things to try:
It might be possible, depending on whether the whitelist will also block the ONVIF port 80 traffic, to use 'ONVIF Device Manager' from sourceforge.net to do a reset to defaults.

If port 22 is open you should be able to connect to a shell using ssh from your Linux box.
something like
ssh root@192.168.0.2
using the admin password.
But - depending on the version of firmware, you may then get hit with the protected shell 'psh' instead of the regular shell.
I don't recall if psh has any system reset options though.
If psh does not feature, use
/sbin/iptables -F
to flush the rules (this is temporary) and get in via the web GUI to change the whitelist.

Another option - as you appear able to access via the Linux box - would be to attempt an HTTP PUT with :

8.1.5 /ISAPI/System/factoryReset
/ISAPI/System/factoryReset
General Resource v2.0
PUT
Description It is used to reset the configuration for the device to the factory
default.
Query mode
Inbound Data None
Success Return <ResponseStatus>
Notes:
Two factory reset modes are supported:
“full” resets all device parameters and settings to their factory values.
“basic” resets all device parameters and settings except the values in Network Service.

 

[feganmeister]

Thanks alastairstevenson, some good suggestions there which I will try later and post back the results.

 

[feganmeister]

Quite possible I'm not doing things right, but I've not made any progress yet

• ONVIF

I can't find a non-payware version of ONVIF for Ubuntu 16 so I skipped this option for now.

• SSH

Times out on port 22. I've made sure the firewall is disabled but not sure what else to try. As a note, when scanning with nmap, 22/tcp shows "filtered" and 22/udp shows "open|filtered", which I suppose is the IP whitelist at play?

• PSH

I've not used this before so not sure I understand how to execute it. Is this the right package?

• HTTP PUT

As with SSH, I got a timeout trying these commands:

curl -X PUT http://admin:password@192.168.0.3/ISAPI/System/factoryReset?full
curl -X PUT --user admin:password http://192.168.0.3/ISAPI/System/factoryReset?full

Any feedback is appreciated!

 

[alastairstevenson]

22/tcp shows "filtered"

That's the default status - dropbear (SSH server) is running but iptables has a rule to drop packets on port 22.
Kinduv hoped from your initial post that port 22 would have been open

'psh' is Hikvision's 'protected shell'. It's a limited shell with a subset of commands, missing anything that would allow privileged access.
From what I recall, it was introduced around the 5.3.0 version of firmware.

ONVIF Device Manager is a Windows-only tool - but it can be very useful.

On the curl - it looks like that access is being blocked by the whitelist. But why, if the source IP address is 0.0 ?

As an off-the wall idea - you can change the camera IP address with SADP (that means you have Windows, so could try ONVIF Device Manager?), so maybe change to a different network segment as opposed to a different IP address, to see if the whitelist breaks. If that makes sense.