Help with partially bricked? DS-2CD2732F

[hardatk]

The camera just stopped working one day, I hadn't updated it, nor do I believe it to be hacked (all my cameras sit behind a BSD firewall). The other cameras are still working fine.

It shows up in SADP with the IP 192.0.0.64 and the serial now shows it as a DS-2CD-min-system... I can ping it, and even ftp and telnet in, but when I try and use the tftp-update tool it does not attempt to call into the server. I'm fairly certain I've followed the steps correctly.

Is there a way to manually update it via FTP / Telnet rather than relying on the auto-updater?

BTW... As far as I know it is a valid US region serial if that matters.

Thanks in advance!

 

[alastairstevenson]

I can ping it, and even ftp and telnet in,

In which case you can use the 'update' shell command which will pull a digicap.dav from either the tftp updater or a normal tftp server.
Assuming the shell is not 'psh', in which case the 'brick-fix tool' will be needed to get the original shell back. But if telnet is working, it will already be the original shell.
Use 'set' to see what the environment variables for $IP and $SERVER are set to so you can set the PC IP address to match.

 

[hardatk]

So... I noticed when I log in as root:12345 it immediately says it cannot chdir to /root... not sure if that is normal or not, but the shell itself is "sh". However $IP and $SERVER do not show up as environment variables... and even setting them up (assuming $IP is the local IP, and $SERVER is the IP of the tftp server) does not get the update command to work, it does show that it's attempting to download from the correct IP, but it just says "Download File [FAIL] error: tftp"

 

[hardatk]

Well... I got past that issue... I read the update script itself and noticed it also needed the $MS_ACTION variable set... so with that it properly called back and downloaded the firmware...

That said, now after a reboot it doesn't come back up at all... and after a power cycle it's back to what I'm guessing is the default image?

I was using the V5.4.5 build 170123 firmware to flash... should I use something else and then upgrade to 5.4.5 and newer?

 

[alastairstevenson]

I noticed when I log in as root:12345 it immediately says it cannot chdir to /root...

Just an oversight in the profile - not a real error.

However $IP and $SERVER do not show up as environment variables...

Oops .. my mistake. I forgot that these bootloader environment variables are only inherited by the serial console session, and not exported to a telnet session.
I'm so used to having a serial console hooked up to a test device for convenience it's easy to forget.
But check the results of :
cat /proc/cmdline
to see what the bootloader environment is set for.

I was using the V5.4.5 build 170123 firmware to flash.

Unless the camera is a 'full English upgradeable' device that version is bound to fail, until the 'enhanced mtd hack' has been done.

As you don't have 'psh' as the shell, the camera may be old enough to not have the 'downgrade block' that's in place after firmware 5.4.0 or above has been tried, in which case the '5.3.0 to 5.2.5 downgrader' should get it back to a working state ready for an mtd hack. There is both an EN and CN header version in the second link here : Custom Firmware Downgrader 5.3.0 Chinese to 5.2.5 English
If there is a downgrade block - check out the 'brick-fix tool' here : Hikvision DS-2CD2x32-I (R0) brick-fix tool / full upgrade method / fixup roundup.

 

[hardatk]

Wow... I had thought that my cameras were legit US versions... I bought them from Amazon (albeit from a third party). The web GUI was in English so I didn't think any thing of it...

Now I see that their serial #s clearly mark them as Chinese versions.

Thanks for your help, I guess I'll look into hacking it.

 

[RBW]

and even ftp and telnet in

I have a Chinese camera that I have forgotten the password so am starting to read up on this. However I’m struggling a bit with the terminology. Can somebody please explain in layman’s terms the above quote.

 

[alastairstevenson]

I have a Chinese camera that I have forgotten the password so am starting to read up on this.

If it has one of the many firmware versions with the 'Hikvision Backdoor' check out the @bp2008 password reset tool that exploits that vulnerability : Hikvision camera admin password reset tool
What version of firmware is the camera using?

 

[RBW]

The camera is a DS-2CD2032F-I

Software version 5.2.5
DSP Version 5.0

 

[alastairstevenson]

Software version 5.2.5

Well, the reset tool should work just fine on that.

 

[RBW]

Well, the reset tool should work just fine on that.

Hmm tried it but it didn't work. The date the camera thinks it is, is that the cameras start date?

 

[alastairstevenson]

Did you use the new tool? I don't think that requires the start date, it uses the backdoor vulnerability.