Help with un-bricking Hikvision DS-7608 NI K2 NVR

[z0re]

Hi,
I got a Hikvision DS-7608NI K2 NVR from auction which was password locked. When I started the NVR everything loaded fine till it asked for the password. I tried to get the password from Hikvision but the file they sent did not work. I could see the NVR on the network via SADP tool.

To reset the NVR I tried to upgrade the firmware via TFTP server. It was running V3.4.101_build180904. I thought ill upgrade to the next version up which was V3.4.102_build181123. This file was accepted by the NVR but not loaded into the firmware. I kept getting this from TFTP server.

TFTP server [192.0.0.128] initialized
Connect client success [192.0.0.64]Success
Start file transmitting[C:\TFTP-Update\digicap.dav]
Connect client success [192.0.0.64]Success
Start file transmitting[C:\TFTP-Update\digicap.dav]
Connect client success [192.0.0.64]Success
Start file transmitting[C:\TFTP-Update\digicap.dav]

I thought maybe I was using the wrong firmware. I tried to load the same version firmware currently on the NVR (V3.4.101_build180904) to see if that did anything but this was still the same. I then tried all newer firmwares but all of them did the same as previous. I then tried to downgrade the firmware to see if that did anything different but the same above cycle repeated. However, I was able to load and successfully transfer V3.3.9 bulid151228 English+ Multi-language firmware. In doing so, I bricked the NVR. I now get no video output. The NVR keeps rebooting on startup. I am still able to connect to the NVR via TFTP server. However SADP tool no longer picks up the NVR.

I am certain the NVR is international version and not Chinese version. There is no CH in the serial number. Any advice on how to unlock this? This NVR model does not have a serial port on the rear however does have a JP8 connector on the board, can I use this to gain serial port access to debug/load firmware on it?

Any help much appreciated. Thanks

 

[alastairstevenson]

To reset the NVR I tried to upgrade the firmware via TFTP server. It was running V3.4.101_build180904. I thought ill upgrade to the next version up which was V3.4.102_build181123. This file was accepted by the NVR but not loaded into the firmware. I kept getting this from TFTP server.

The Hikvision tftp updater has a 32MB filesize limit - so the firmware for that NVR at 41MB is too large for it.

However, I was able to load and successfully transfer V3.3.9 bulid151228 English+ Multi-language firmware.

That older firmware is smaller than the 32MB filesize limit.

I bricked the NVR. I now get no video output. The NVR keeps rebooting on startup.

You've bumped into the 'downgrade block' which prohibits installing any firmware older than the newest major version that's been (even just attempted to be) installed.

You can either try a tftp update with Scott Lamb's Python clone of the tftp updater :

GitHub - scottlamb/hikvision-tftpd: Unbrick a Hikvision device (NVR or camera) via TFTP

Unbrick a Hikvision device (NVR or camera) via TFTP - scottlamb/hikvision-tftpd

github.com

or
Connect up to the serial console and access the inbuilt updater menu, using a normal tftp server such as this :

Tftpd32: an opensource free firewall friendly dhcp, syslog sntp and tftp server/service for windows, tftp client

A free tftp and dhcp server for windows, freeware tftp server

tftpd32.jounin.net

 

[alastairstevenson]

This NVR model does not have a serial port on the rear however does have a JP8 connector on the board, can I use this to gain serial port access to debug/load firmware on it?

The serial console is on a 4-pin 1.5mm JST ZH connector on that model.

I got a Hikvision DS-7608NI K2 NVR from auction which was password locked.

I think I was watching that item on eBay.

 

[z0re]

Thanks for the reply.
Do you know if Scott Lamb's Python clone update will bypass the 32mb file size?

The K series does not have a serial console connector on the rear. However does have a 4 pin JP8 connector which I am guessing is a serial port. Do you know if this is the case? Thanks

 

[alastairstevenson]

Do you know if Scott Lamb's Python clone update will bypass the 32mb file size?

Yes, no filesize limits on it.
What was the newest firmware version you even tried?

However does have a 4 pin JP8 connector which I am guessing is a serial port. Do you know if this is the case? Thanks

I don't recall if it's called J8.
But it's the 'standard' Hikvision 4-pin 1.5mm JST ZH connector.
You can buy wired connectors off eBay, usually sold in 10-packs.
And you'll need a serial TTL to USB convertor, say a PL2303TA-based device. Note - it's not RS232, it's serial TTL.

 

[z0re]

I think I was watching that item on eBay.

I did not buy from eBay

Thanks will try updating wtih Scott Lamb's Python clone of the tftp updater first then the NVR serial port second thanks

 

[alastairstevenson]

I did not buy from eBay

Maybe Gumtree?
I watch that too, not that there is much of interest, but I've had a few useful items in the past.

 

[z0re]

Maybe Gumtree?
I watch that too, not that there is much of interest, but I've had a few useful items in the past.

It was from john pye auctions. full cctv camera system. ive unlocked the camera. Just the NVR left now.

 

[alastairstevenson]

ive unlocked the camera. Just the NVR left now.

On a PoE NVR, cameras usually added 'Plug&Play', the NVR by default uses it's own password to 'Activate' the cameras.

Did you reset the camera, or extract the password?

If you have or can borrow, a camera with backdoor-vulnerable firmware (5.4.0 or older) you can reset it to defaults and plug in to the NVR to extract the NVR password.
The 'Trojan horse' method.

 

[z0re]

I did not know this, will have to look into this.
unfortunately in my case the cameras have all been reset. some were simple reset button. the larger bullet cameras were firmware upgrade but all the file sizes were below 32mb

 

[alastairstevenson]

unfortunately in my case the cameras have all been reset

And does SADP show any firmware versions of 5.4.0 or older?

 

[z0re]

no cameras are running 5.5.3.
However if they were not, how could I use this exploit?

 

[alastairstevenson]

You'd have to have used it before bricking the NVR.
The method involves connecting an 'Inactive' camera to an NVR PoE port to 'Activate' it, then pulling the camera configuration file through the backdoor. Then decrypting the configuration file to reveal the password.

 

[Safayth1993]

How do you scottlamb script?

 

[alastairstevenson]

How do you scottlamb script?

Install Python2 on your PC.