Here's how to read Hikvision serial numbers

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
That's a pity.
I'd wondered if the camera firmware may have been old enough to have the Hikvision backdoor, so the camera could be reset to defaults and used to extract the NVR password.
But they aren't.
Thank you for your help. Do I have any other options?

1. Verify by Reversed Email says "No reserved e-mail address exists. You cannot use this way for verification."
2. Verify by GUID - I dont have GUID file
3. Verify by Security Question says "Set the security question first"

So looks like the system was just setup without setting up any recovery options as well.

Is it possible to own grade one of the camera's firmware to get backdoor access?

Also for some reason SADP pulls NVR with 0.0.0.0 ip. Is there away to give it an IP? Maybe DHCP is disabled on the NVR... trying to export security key to see if support would help reset it.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
previous owner provided the password which I used to reset the password but now I cant remember it for life of me.
Can you just clarify - which password have you forgotten?
The original password for the NVR, which the previous owner provided (which is likely what the NVR used to connect to the cameras)
or
The new password that you applied to the NVR.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Cam 1 firmware: V5.6.0 build 190507 - (Cam model # DS-2CD2785G0-IZS)
Cam 2 firmware: V5.4.7 build 180611 - (Cam model # DS-2CD4A26FWD-IZHS8/P)
The downgrade block will not allow Cam 1 to have backdoor-vulnerable firmware installed.
But there is a small possibility with Cam 2
I think you'd have to connect it to the LAN and power it with an external 12v supply, and use the Hikvision tftp updater.
I believe there are variants of firmware for that ANPR camera, and it's uncertain if they are vulnerable.
One candidate is attached.
 

Attachments

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
Can you just clarify - which password have you forgotten?
The original password for the NVR, which the previous owner provided (which is likely what the NVR used to connect to the cameras)
or
The new password that you applied to the NVR.
The original owner provided admin password for NVR which I changed and forgot.

Camera passwords were not touched by me and the password provided by previous owner doesnt work on cameras.

Is it possible for me to buy a camera from ebay that has the vulnerability to retrieve NVR password?
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
The downgrade block will not allow Cam 1 to have backdoor-vulnerable firmware installed.
But there is a small possibility with Cam 2
I think you'd have to connect it to the LAN and power it with an external 12v supply, and use the Hikvision tftp updater.
I believe there are variants of firmware for that ANPR camera, and it's uncertain if they are vulnerable.
One candidate is attached.
I filed out password reset form on hikvision's website so let's see if they are able to provide me encrypted key or not otherwise I'll have to attempt this.

If I go this route, is there anyway to backup the settings or you cant without password?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Is it possible for me to buy a camera from ebay that has the vulnerability to retrieve NVR password?
That's worth a look, certainly.

If I go this route, is there anyway to backup the settings or you cant without password?
An export of the NVR settings requires a valid login.
But if it's only the password that gets reset by the Hikvision code, the rest of the configuration is still intact.
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
That's worth a look, certainly.


An export of the NVR settings requires a valid login.
But if it's only the password that gets reset by the Hikvision code, the rest of the configuration is still intact.
I submitted request to Hikvision about 5 hours ago and its 1:48am pst sunday. Hopefully tomorrow they are able to send me encrypted key. My chances of getting it is pretty low best on what I am reading from all the comments on this form as I am not the original purchaser.
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
That's worth a look, certainly.
Ok so i got hold of a camera with v5.3.0 where i am able to download the configfile from http://192.168.254.8/System/configurationFile?auth=YWRtaW46MTEK. Is this config file supposed to include password for NVR? i only see two admin users and first one the password is 12345 and the 2nd one is pass4cam which is the one i set when activating camera. Are there instructions on how to add the camera so it is used to retrieve NVR password?

Edit: It looks like I need to have NVR activate the camera instead of me activating through SADP. How does one force NVR to activate the camera plugged into POE port?
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Reset the camera to defaults so that it is 'Inactive' and plug it into an NVR PoE port.
The NVR will activate the camera if the port is set to Plug and Play mode, which is the default.
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
Reset the camera to defaults so that it is 'Inactive' and plug it into an NVR PoE port.
The NVR will activate the camera if the port is set to Plug and Play mode, which is the default.
It doesn't look like port is set to plug and play since camera stays in Inactive state forever until i activate it through SADP. Is there anyway to set the port to Plug and Play without having password for NVR?
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
I kept trying different things and some how the new camera got 192.168.1.9 ip and it registered itself and i was able to recover the password!

alastairstevenson thank you very much for all your help!

quick question - anyone aware of documentation that you can point me to on figuring out how to turn on audio? currently the system is only recording video.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I kept trying different things and some how the new camera got 192.168.1.9 ip and it registered itself and i was able to recover the password!
Well that's a sudden and unexpected development after what you've described earlier.
And an unusual IP address if that's when the camera is connected to a PoE port.

If i plug this new camera running V5.3.0 into port 1, 2, or 3, it does not power on. Does that mean NVR is expecting the camera to have specific ip and therefore not powering it own or those ports are not set to plug and play?
If the port is in Manual mode and the IP address defined on it is a LAN IP address, PoE is disabled on some versions of firmware / NVR.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
I think, based on what you've described about the NVR behaviour when trying to Activate the camera, it would be a good idea to review the NVR configuration to see where changes from default settings have been made that might trip you up going forward.

Also - check out the 'Lost password' link at the login page, or the security page, where password recovery options can be set up.
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
Well that's a sudden and unexpected development after what you've described earlier.
And an unusual IP address if that's when the camera is connected to a PoE port.


If the port is in Manual mode and the IP address defined on it is a LAN IP address, PoE is disabled on some versions of firmware / NVR.
i dont know how this worked because i tried it earlier and camera kept showing 'Inactive'... what i did this time was to unblock existing camera plugged into port 2 and plugged that into port 6 and plugged the new one into port 2. i dont know how that makes any difference but it worked so i'm very happy i recovered the password :)
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
quick question - anyone aware of documentation that you can point me to on figuring out how to turn on audio? currently the system is only recording video.
In the NVR Configuration | Video/Audio page, check that stream type video/audio is selected.
1589616517718.png

And also under Storage | Schedule settings | Advanced :
1589616621810.png
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
In the NVR Configuration | Video/Audio page, check that stream type video/audio is selected.
View attachment 61811

And also under Storage | Schedule settings | Advanced :
View attachment 61812
For some reason i dont have any of these settings... maybe im running outdated software on NVR? it says NVR 4.0 top left.

Getting access to all these settings for the first time is overwhelming.
 

Smd776

n3wb
Joined
May 9, 2020
Messages
14
Reaction score
1
Location
Santa clara, ca
That's the newest generation of firmware.

On the NVR web GUI?
sorry i am a newbie :( i was on the NVR UI through monitor connected using HDMI. I finally figured out how to log into NVR WebUI and made the changes you recommended . Now i have audio as well :)

Are you aware of any guide/documentation on how to setup system like this so its setup to take advantage of all the features it offers as well as how to make sure it doesnt get hacked when/if i connect it to the internet. Right now its not connected to the internet.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
That's good that you enabled the audio.

For the avoidance of doubt - what do you mean by 'connect to the internet'?
That will guide the responses.
 
Top