Hikivision firmware 5.3.0

dingbatca

n3wb
Joined
Jun 25, 2015
Messages
11
Reaction score
5
I cant break out of "BusyBox v1.2.1 Protect Shell (psh)", but I can avoid it. :)

Code:
ssh root@<IP of camera> "ash -c 'ls /dav'"
root@<IP of camera>'s password:
ASC16.bin
GBK
IEfile.tar.gz
WebComponents.exe
_cfgUpgClass
_cfgUpgSecPls
...
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,963
Reaction score
6,794
Location
Scotland
Creative!
Have a go with this fragment from an NVR initrun.sh, in particular see if dropbear is running and see if you can unblock it:

echo "-----------------<List the port filtering and flush any. Dropbear always runs, SSH just gets blocked>---------------"
/bin/iptables -L
/bin/iptables -F
# Fix the execute permission just in case
chmod 755 busybox-armv6l
chmod +s busybox-armv6l
cp busybox-armv6l /bin
ls -al /bin
echo "-----------------<Add new Busybox commands to supplement existing>---------------"
/bin/busybox-armv6l --install -s /bin
# ls -al /bin Far too many to list!
echo "-----------------<inhibit the busybox protected shell>---------------"
mv /bin/psh /bin/psh_orig
ln -s busybox /bin/psh
# ls -al /bin Far too many to list!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,963
Reaction score
6,794
Location
Scotland
Ignore my Dropbear comment - of course it's running if you can ssh in to the camera. But the rest may be interesting.
 

dingbatca

n3wb
Joined
Jun 25, 2015
Messages
11
Reaction score
5
Here is full command line access. Its a really crude hack, but it works. :)
Code:
ssh root@[COLOR=#333333]<IP of camera>[/COLOR] "ash -c 'mv /bin/psh /bin/old_psh'"
ssh root@[COLOR=#333333]<IP of camera>[/COLOR]
root@[COLOR=#333333]<IP of camera>[/COLOR]'s password:

BusyBox v1.19.3 (2015-03-20 17:37:48 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.


-sh: /bin/psh: not found
# ls /
bin      dav      dev      home     linuxrc  opt      root     srv      tmp      var
config   davinci  etc      lib      mnt      proc     sbin     sys      usr
 

Deman

n3wb
Joined
Aug 7, 2015
Messages
2
Reaction score
0
thank. but there was a small problem
tftp server launched
....
Complete file[...\5.30 Downgrader\digicap.dav] transmit
and then nothing happens
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,963
Reaction score
6,794
Location
Scotland
What firmware did you use?
If you really did use "5.30 Downgrader" from whoslooking then it is not for a 2xx0 camera.
 

pauldrb

n3wb
Joined
Aug 15, 2015
Messages
1
Reaction score
1
Hi! I don't know if it has been said before, but there is an easy way to switch to english language the web menu of your camera. Go to the login web page and the type javascript:chooseLanguage("en") in the address bar of your browser. Repeat if necessary. The only problem is that it's not a permanent solution.
 

Del Boy

Getting comfortable
Joined
Mar 19, 2015
Messages
2,727
Reaction score
294
Location
UK - England
Hi! I don't know if it has been said before, but there is an easy way to switch to english language the web menu of your camera. Go to the login web page and the type javascript:chooseLanguage("en") in the address bar of your browser. Repeat if necessary. The only problem is that it's not a permanent solution.
This won't fix language mismatch issues though if you are using an NVR.
 

ansel

n3wb
Joined
Sep 3, 2015
Messages
5
Reaction score
0
Hi Whoslooking, good job. I can test the modified firmware for you and share the result to you and forum members liked I did for alastairstevenson. The camera is in chinese 5.3.0 now, so it is not useful for me. Thus any test are welcomed even at risk of brick.Best regards
V5.3.0 build 150327 in Chinese is what I got and can't really use it either. Anyone got anything that can make it go back to English? on the tag on back of cam I says 5.3.0
 
Top