"Grey" market camera, forgotten password

[Liam Retrams]

Hello friends,

I've got a Hikvision DS-2CD3335-i that I got from eBay.

I've forgotten its password. At this stage, It says it will allow 6 logins before it becomes locked down. I have already used 4 trying to guess what it might be without success.

Using the SADPTool, The "Device Serial No" field shows DS-2CD3555-I20160626AACH617122572

Is there any way to recover password for this thing? I found this link Hikvision Password Reset Tool but the serial number format in the referenced document doesn't seem to match the format SADPTool is showing me.

Thanks.

 

[GCoco]

Did you follow the instructions for setting the correct date? Your password looks okay to me. The password shown in the instructions is fo a NVR, that is why there are letters at the end. Cameras don’t have letters at the end.

 

[alastairstevenson]

the serial number format in the referenced document doesn't seem to match the format SADPTool is showing me.

That's the password reset tool that works if the firmware pre-dates 5.4.5 (shown in SADP) and has the Hikvision backdoor present.
Check the firmware version is SADP to see if it applies.

Alternatively - and this can work in some cases where the updated tool above did not - try this URL and see if it extracts a configuration file, replacing the IP address as needed :
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK
If it does extract a configuration file, zip it up and attach it and I should be able to decrypt and decode it, and extract the password for you.

 

[Liam Retrams]

Thanks - I have private message'd you the file that was generated when I browsed that link.

 

[alastairstevenson]

I have private message'd you the file that was generated when I browsed that link.

Well done.
And I have extracted the password from the file - check your conversation.

 

[Liam Retrams]

Alastair - killed it! Thanks so much.

 

[alastairstevenson]

You are welcome.
By the way - be aware that this means the camera is running firmware that is vulnerable to the 'Hikvision backdoor', so it must not be exposed to access by unknown sources, such as by 'port forwarding'.
But I do know that DS-2CD3335-I cameras can be tricky to update.
Possibly it's a China region model?

 

[Liam Retrams]

I am not at all worried about that - I would never expose any of this stuff to the internet. I have it VLAN'd off on a different network and communication in/out of that VLAN are controlled by a firewall.

Edit - possibly, I got them from ebay. They came with a piece of paper that said (in all caps) "DO NOT ATTEMPT TO UPGRADE FIRMWARE"

 

[mossdrive]

That's the password reset tool that works if the firmware pre-dates 5.4.5 (shown in SADP) and has the Hikvision backdoor present.
Check the firmware version is SADP to see if it applies.

Alternatively - and this can work in some cases where the updated tool above did not - try this URL and see if it extracts a configuration file, replacing the IP address as needed :
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK
If it does extract a configuration file, zip it up and attach it and I should be able to decrypt and decode it, and extract the password for you.

Hello, just came across this post and I know its old but I have the same issue with a DS-2CD2342WD with version 5.4.1 firmware. Are you still able/interested in decoding a config file? Much appreciated if you are!

 

[alastairstevenson]

Are you still able/interested in decoding a config file?

Yes, no problem! It's quick and easy to do.

The password for admin on the HIKVISION DS-2CD2342WD-I - 6386769 camera is -

Greg2425.

 

[mossdrive]

Yes, no problem! It's quick and easy to do.

The password for admin on the HIKVISION DS-2CD2342WD-I - 6386769 camera is -

Greg2425.

Thank you so much Alastair, that worked like a charm

 

[Zeeshan Aamir]

Serial Number 51247770

 

[Zeeshan Aamir]

Model DS-7204HUHI-K1/ECO
Serial NUmber D51247770
How to Reset Password

 

[gazzaman2k]

hello i have 2 DS-2CD3345-I which i plugged into my nvr after being on a poe switch it has changed the passwords and i can no longer log into them, could someone help me please they are v5.4.52 version and the password reset tool just doesnt seem to work, ive tried hik12345, 12345, vik12345, 123456789abc, password, admin my old passwords and i just cant get into them ive locked the camera somany times trying to guess the password now that it has somehow changed, ive even had the camera looking for pin locations to factory reset them but cant find any pins or points inside the cam.

i have generated one file on sadp to see if that will help can anyone help me decode it to get the password back again?

thanks

 

[alastairstevenson]

A couple of possibilities, depending on how there NVR PoE ports are configured and the cameras were added :

But default, the NVR will have used it's own password on the cameras when automatically added under Plug&Play mode.
There is also an alternative camera password that can be configured on the NVR for when cameras are added.

 

[gazzaman2k]

hi alastair the ip range used to be 192.168.0.x and static pc address when i plugged into the nvr it has now moved the ip to 169.254.115.x which is not the 192.168.254.x poe domain on the nvr so i have no idea whats its done to them, i can log into the loggin page on my pc if using a poe switch but i cant no longer get into the camera, i even changed the verification code on the nvr and such tried that to log in too and no joy i was giving these to my mum as i just got 8 new colorvu cams so was giving her 3 cams and a new 4channel k4 nvr but now 2 cams i cannot get working as its messed up all the settings

 

[alastairstevenson]

the ip range used to be 192.168.0.x and static pc address when i plugged into the nvr it has now moved the ip to 169.254.115.x which is not the 192.168.254.x poe domain on the nvr so i have no idea whats its done to them

That's a 'self-administered address range' which a device uses when its network is set to use DHCP and there is no DHCP server.
As would be the case when plugged in to NVR PoE ports.
It's not the NVR doing this.

Suggestion to fix - assuming you know the camera admin password and assuming it's the same as the NVR admin password :
Please confirm that you know both the camera and NVR admin passwords and if they are the same.
If not the same - an extra step is needed.

On the NVR web GUI, access the System | Camera configuration page and note the IP addresses associated with each channel, those in the range 192.168.254.x range as you've seen already.

On one camera at a time -
Connect the camera to the PoE switch, and use SADP to change the camera IP address to match that of the NVR channel that you will be connecting the camera to.
Use 192.168.254.1 as the default gateway.
Disconnect the camera and connect it to the chosen NVR PoE channel.
If the camera admin password is not the same as the NVR admin password, in the NVR web GUI, Camera Management page, change the mode of the channel to Manual from Plug&Play and change the password to match that of the camera.

Repeat as needed.
Hopefully that should sort out the problem.

 

[gazzaman2k]

thats where the problem is that the default password has changed, and i dont know it ive emailed the seller on ali express but i hold no hope as they were purchased back in 2017, my last set i had in 2018 default was vik12345 but ive tried so many default grey market passwords and still cannot get in i was hoping somone could decryt the SADP tools backup i done

 

[alastairstevenson]

they were purchased back in 2017

Were they connected to PoE ports on another NVR?
if so - the NVR would have used it's own admin password to 'Activate' them.

What does SADP show for the camera firmware versions?
If its 5.4.0 or earlier - the password can be extracted as the configuration file can be coughed up with no credentials.

 

[gazzaman2k]

no they were static ip on a poe switch home network, they were not connected to a nvr but used to save to a nas drive on the network.

v5.4.52 build170572