Camera Passwords - Behind Virtual Host

Robert G.

Robert G.

Getting comfortable
Oct 6, 2018
303
580
North America
I have an 8 channel NVR up and running (DS-7608NI-I2/8P) with 5 cameras, 3 different models.

Two of the cameras I played with before connecting them to the NVR... so I did set the password on two of them.

Then I installed them on a building, powering them with POE on the NVR.

I enabled virtual host, so I could access the cameras directly to manage them.

Problem is, the password I set on two of them don't work anymore. The three I installed directly into the NVR I never set any password.

At this point I can't login to any camera (they all communicate with the NVR just fine), the SADP tool can't see them on the network.

How am I supposed to login to the cameras when they are behind the NVR? I can get to the login screen of each camera no problem, but no idea what the passwords are.
 
Robert G. said:
The three I installed directly into the NVR I never set any password
Click to expand...
If using Plug&Play in the channel configuration - the NVR by default will use it's own password to configure the cameras that are added under Plug&Play.
Though there is an option in the newest firmware to be able to specify a different, camera-specific, password under Plug&Play.
 
  • Like
Reactions: gwminor48
Don't suppose there is any way to have the NVR set the password again is there?

The NVR fimware is reported at V4.1.10 build 171107 and I don't see any option to set a custom password.

I have the option to take the camera out of Plug-and-Play mode, at which point I can enter a username/password.
 
I tried the NVR password and a bunch of other passwords as well. When you first setup the NVR it forces you to supply an initial password. That would be the password it would have used to sync up the cameras as I understand it. I can't be 100% certain what password I used the very first time on the NVR as it was quite a while ago.

I don't have physical access to the NVR to set the custom password, until April 2019 so I will have to live with things as they are until then I guess.
 
Robert G. said:
I don't have physical access to the NVR to set the custom password, until April 2019 so I will have to live with things as they are until then I guess.
Click to expand...
It sounds like you have remote access to the NVR (not going to ask by what method ...), that is not local to you.

If it is the original, since forgotten, NVR password that's been applied to the cameras, it might be interesting to try this, which should work for camera firmware older than 5.4.5 -
Replacing the 'xx' with the NVR PoE channel number of interest (01,02,03 etc), and the NVR IP address with it's actual, try this in the browser :
http://<NVR_IP_address>:650xx/System/configurationFile?auth=YWRtaW46MTEK

If that brings out a configuration file, zip it up and attach it here and I'll decrypt and decode and extract the password for you. And can return it via 'conversations' if you wish.
 
  • Like
Reactions: gwminor48
alastairstevenson said:
Replacing the 'xx' with the NVR PoE channel number of interest (01,02,03 etc), and the NVR IP address with it's actual, try this in the browser :
http://<NVR_IP_address>:650xx/System/configurationFile?auth=YWRtaW46MTEK

If that brings out a configuration file, zip it up and attach it here and I'll decrypt and decode and extract the password for you. And can return it via 'conversations' if you wish.
Click to expand...

That sounded interesting, I actually don't have a record of the firmware of the camera but they were all purchased in 2018. I tried to extract the configuration file but for all cameras received a 404 Not Found error.

Access Error: 404 -- Not Found
Request Refuse: cgi integrate function is disabled.

Is that the reply when the vulnerability bug has been patched?
 
Last edited:
  • Like
Reactions: aung min
Something else interesting here. I found a record in my password management software (LastPass type of software), it is listed as HIKVision Cameras password. It also contains notes of the recovery questions/answers that I used when I setup the cameras (without the NVR) the first time.

The password does not work and when I try and do the reset password option, it informs me 'No answer is set for security question'. Obviously this is not true for all my cameras since I have a record.

So clearly when I moved the cameras from being stand alone, to be HIKVISION plug-and-play behind the NVR it wiped out the passwords and recovery questions.
 
Robert G. said:
I tried to extract the configuration file but for all cameras received a 404 Not Found error.
Click to expand...
That's a pity - it would have been interesting and easy to extract the passwords.

However - on 2 counts, it seems that the Hikvision backdoor-driven exploit of extracting the configuration file isn't available as the camera firmware is new enough that it's a fixed version.
The 'CGI enable' facility, and the 'Security questions password reset facility' are both only in the newer firmware.

But when you do eventually have access to the NVR VGA/HDMI interface, there is a tickbox in the Camera Configuration screen to 'Show camera passwords' which should provide the info you are looking for.
 
alastairstevenson said:
But when you do eventually have access to the NVR VGA/HDMI interface, there is a tickbox in the Camera Configuration screen to 'Show camera passwords' which should provide the info you are looking for.
Click to expand...

Do you know where the documentation would be, and/or a screenshot? I have someone with NO technical skill at all, who might be willing to drive there in a month or two. If I can step them through the process I should be able to gain access to the cameras without having to wait until April 2019.
 
At the VGA/HDMI interface on the monitor -
Right-click the mouse and select 'Menu'
Log in as directed - use the 'unlock code' if you have set it, if not the on-screen keyboard.
At the menu screen, click the Camera icon.
The tickbox 'Show password of IP camera' is at the top left, and requires an admin logon confirmation using the on-screen keyboard.
 
You must log in or register to reply here.
Top Bottom