Help with password reset of DS-7104NI-SN/P

[cmdwedge]

Hi guys,

Sorry if this has been done to death. I've read as many threads as I can about resetting the NVR password.

I've inherited a Hikvision system with a DS-7104NI-SN/P and three Hikvision cameras connected via Ethernet. It has never been on a network before but I've plugged it into my switch and can access the login prompt. Unfortunately nothing seems to work for the password.

I've used the SADPTool and discovered the following:

Software version: V3.0.13build 150429
DSP version: V5.0 build 150413

Using the password reset tool here: Hikvision Password Reset has not worked. Device rejected error.

Are there any other options open to me? The reseller of this device is long gone.

Thanks very much! cmdwedge

 

[alastairstevenson]

Are there any other options open to me?

This is a long-shot suggestion - the method works OK for a DS-76xxN-Ex/nP but to my knowledge has not been tried on a 7104NI-SN/P
But there's a first time for everything, and it's easy enough to try.

Assuming the 3 cameras are connected to the NVR PoE ports -
Using SADP (SADP Tool) on a PC, connect the PC to the unused NVR PoE port.
The cameras should appear automatically in the SADP list.

Check the version of camera firmware shown by SADP, and note down the camera IP addresses.
The method requires that the firmware is older than 5.4.4 but not older than 5.3.0, and that the cameras were added to the NVR using 'Plug&Play'.
Temporarily change the PC IP address to be in the same range as the IP addresses of the cameras.
On the E-series NVRs this would be in the range 192.168.254.x in which case the PC IP address could be 192.168.254.100

In the browser of the PC, use the URL below, replacing the camera IP address as needed.
With the right versions of camera firmware, this should download a configuration file.
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK
Repeat for all cameras - naming the files as needed.
Zip up the files and attach here, and I will decrypt and decode and extract the password.

On the E-series NVRs, when cameras in an 'Inactive' state (ie reset to defaults with firmware 5.3.0 or newer) are added to an NVR PoE port in Plug&Play mode, by default the NVR uses its own password to 'Activate' the camera.
For camera firmware of 5.4.4 or older, the 'Hikvision backdoor' vulnerability can be used to pull a configuration file with no authentication required.

I'll keep my fingers crossed!