Alternative way of recovering HikVision NVR password

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
What is the firmware version in the cameras?
If it's 5.4.0 or earlier, it should be possible to extract the admin password.
 

harry43211

n3wb
Joined
Nov 10, 2021
Messages
3
Reaction score
0
Location
australia
What is the firmware version in the cameras?
If it's 5.4.0 or earlier, it should be possible to extract the admin password.
They are all on version V7.3 190128 , Is it possible to downgrade them? to 5.4.0 Or earlier. As it would be a pain to send all 8 XML files to hikvision without a guarantee they will help me.

The problem i am in is, i know my NVR password etc, however i cant for the life of me remember the camera password. And i know they are all the same. I just cant remember them

So i can't change firmware on IVMS or hikvision / camera login. Any help would be amazing!

Also cant get the config file for you as i believe the firmware is the cause,
I get this:

Requested method GET not supported for URL: /System/configurationFile
Apparently turning on ONVIF in camera settings fixes this however i can't even access any camera settings as i don't know the camera password.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
They are all on version V7.3 190128
That's not a recognised Hikvision firmware version.
How are you deriving that?

Are the cameras connected to NVR PoE ports?
If so - check out this post :
 

harry43211

n3wb
Joined
Nov 10, 2021
Messages
3
Reaction score
0
Location
australia
That's not a recognised Hikvision firmware version.
How are you deriving that?

Are the cameras connected to NVR PoE ports?
If so - check out this post :
Ah Very sorry wrong thing copied and pasted, V5.5.82build 190220.
That is the current version of cameras.

"Are the cameras connected to NVR PoE ports?
If so - check out this post : "

Yes they are connected, however as i mentioned in previous reply, i have tried to get the config file however i get this error: when i do

I get this error: Requested method GET not supported for URL: /System/configurationFile
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
V5.5.82build 190220.
That is the current version of cameras.
Unfortunately, that version is too new to have the 'Hikvision backdoor vulnerability' that makes extracting the admin password quite easy.
What model are the cameras / do they have a reset button?
If so - that would be the simplest method of regaining access.

But check if your camera model / firmware version is on this list :

And if so, check this out as a method of wiping the configuration :
 

Vxtus

n3wb
Joined
Oct 24, 2017
Messages
2
Reaction score
0
Hello alastairstevenson

Thanks so much for your help extracting these passwords. I've bought a home with a Hikvision cameras and have the NVR password but not for the cams. Here is the config file from a 5.3.0 DS-2CD2132F-I

I'm hoping it has the same password as the rest of the cameras, and you'll be able to retrieve it.

Thanks!
 

Attachments

Oleglevsha

Getting the hang of it
Joined
Jan 25, 2015
Messages
299
Reaction score
77
Location
Россия г.Волгоград
Hello alastairstevenson

Thanks so much for your help extracting these passwords. I've bought a home with a Hikvision cameras and have the NVR password but not for the cams. Here is the config file from a 5.3.0 DS-2CD2132F-I

I'm hoping it has the same password as the rest of the cameras, and you'll be able to retrieve it.

Thanks!
admin Mogilev1
 

sfitz527

Getting the hang of it
Joined
Apr 25, 2016
Messages
24
Reaction score
34
Would you be able to decrypt the admin password on the attached 3 configuration files? I attempted to do so myself utilizing the steps in the Hikvision backdoor IP camera thread mentioned on page 4, but cannot get the hikvision-world.space - link to work. I'm utilizing an old DS-2CD2032 to get the NVR password off a few eBay specials.
 

Attachments

Oleglevsha

Getting the hang of it
Joined
Jan 25, 2015
Messages
299
Reaction score
77
Location
Россия г.Волгоград
Would you be able to decrypt the admin password on the attached 3 configuration files? I attempted to do so myself utilizing the steps in the Hikvision backdoor IP camera thread mentioned on page 4, but cannot get the hikvision-world.space - link to work. I'm utilizing an old DS-2CD2032 to get the NVR password off a few eBay specials.
Go to the website page by the link and use the form to decrypt the "configuration File" file
To do this, unpack your zip archive and point to your unpacked file "configuration File" in the form window, then click the "View" button
Find the entry "admin" in the text, after which you will see the desired password
HIKVISION DS-2CD2032F-I - 603357533 admin Dy3zzpsw18 for the file configurationFile1.zip
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
can someone help me please with the password for my nvr ?
Unfortunately, that password reset request file can only be processed by a Hikvision support person on one of their private systems.

What cameras do you have connected to the NVR, and what version of firmware are they running?
If the firmware is 5.4.0 or older - the camera configuration file should be able to be exported, and the password extracted.
 

laukkis85

n3wb
Joined
Dec 31, 2021
Messages
4
Reaction score
0
Location
sweden
I was able to get configuration file from the cameras but that russian site gave me admin 12345 and that doesnt work. Camera passwords was admin 1234. Was so excited to get the configuration file from the cameras, so didnt remember to check the firmware version from those. Anymore ideas? I would need to view some video footage from the recorder so I think the recorder firmware flashing isnt an option?
 

Attachments

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Camera passwords was admin 1234
Yes, that's confirmed by decrrypting the first configuration file. The Russian site was correct.

If the camera firmware is old enough that it still uses the hard-coded default passwords when reset to defaults, the NVR when adding the camera under Plug&Play will use those if it finds that they work, instead of using it's own admin password to activate and add the camera.
In other words - very old camera firmware means that this 'trojan horse' method of extracting an NVR password does not work.

If it's the NVR password you are trying to recover - you will need to use a camera that has firmware in the range 5.3.0 to 5.4.0

What does SADP show for the camera models, serial numbers (are they Chinese) and firmware versions?
 
Top