Hikvision camera admin password reset tool

If you need to reset your password, let me know I can help.
 
DS-7108HGHI-E10820150511AAWR518199674WCVU
showing date as
2012-10-03
using latest sadp tool.
tried every possible password. but it says. device rejected.
 
LaZona said:
It was already shared here a few days ago, but someone deleted the post.
Click to expand...
Did it look anything like this?
Hikvision camera admin password reset tool

HTML: 
<html>
<head>
    <title>Hikvision Password Reset</title>
    <script type="text/javascript">
        function padLeft(str, l, c) { str = str + ""; return Array(l - str.length + 1).join(c || " ") + str }
        function initialize()
        {
            document.getElementById("year").value = new Date().getYear() + 1900;
            document.getElementById("month").value = padLeft(new Date().getMonth() + 1, 2, '0');
            document.getElementById("day").value = padLeft(new Date().getDate(), 2, '0');

            document.getElementById("serialNumber").onchange = GenerateSerialCode;
            document.getElementById("year").onchange = GenerateSerialCode;
            document.getElementById("month").onchange = GenerateSerialCode;
            document.getElementById("day").onchange = GenerateSerialCode;
        }
        function GenerateSerialCode()
        {
            var serialNumber = document.getElementById("serialNumber").value;
            var year = document.getElementById("year").value;
            var month = document.getElementById("month").value;
            var day = document.getElementById("day").value;
            var plainText = serialNumber + year + month + day;

            var magicNumber = 0;
            for (var i = 0; i < plainText.length; i++)
                magicNumber += (plainText.charCodeAt(i) * (i + 1)) ^ (i + 1);

            magicNumber *= 1751873395;
            magicNumber = magicNumber >>> 0; // convert to 32 bit integer

            var magicWord = magicNumber + "";
            var serialCode = "";
            for (var i = 0; i < magicWord.length; i++)
            {
                var c = magicWord.charCodeAt(i);
                if (c < 51)
                    serialCode += String.fromCharCode(c + 33);
                else if (c < 53)
                    serialCode += String.fromCharCode(c + 62);
                else if (c < 55)
                    serialCode += String.fromCharCode(c + 47);
                else if (c < 57)
                    serialCode += String.fromCharCode(c + 66);
                else
                    serialCode += String.fromCharCode(c);
            }

            document.getElementById("output").innerHTML = serialCode;
        }
        window.onload = initialize;
    </script>
    <style type="text/css">
        body
        {
            width: 450px;
        }
        .description
        {
            margin: 20px 0px;
        }
        .label
        {
            margin: 10px 0px;
        }
        .input
        {
            margin-bottom: 10px;
        }
        #output
        {
            font-weight: bold;
            border: 1px solid black;
            padding: 10px;
            font-size: 2em;
            max-width: 100%;
        }
    </style>
</head>
<body>
    <div><h2>Hikvision Camera Password Reset Utility</h2></div>
    <div class="description">This tool will generate a <b>password reset code</b> which you may use to reset a forgotten admin password for a Hikvision camera.</div>
    <div class="label">Enter your camera's complete CASE SENSITIVE serial number, as seen in the <a href="Hikvision SADP - Google Search">Hikvision SADP</a> tool:</div>
    <div class="input"><input type="text" id="serialNumber" style="width: 100%" placeholder="Hikvision Camera Serial Number" /></div>
    <div class="label"><b>Important:</b> The date you enter below much match with the camera's clock. <b>Most likely it is not today's date!</b> To find out what date your camera thinks it is, power cycle your camera, give it time to boot up, and then refresh your camera list in SADP and check the Start Time column.</div>
    <div class="label">Enter the <b>4 digit</b> year the camera thinks it is:</div>
    <div class="input"><input type="text" id="year" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> month the camera thinks it is:</div>
    <div class="input"><input type="text" id="month" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> day the camera thinks it is:</div>
    <div class="input"><input type="text" id="day" style="width: 20%" /></div>
    <div class="label">Your <b>password reset code</b> will appear below.</div>
    <div id="output"></div>
    <div class="label">The code must be entered into the <a href="Hikvision SADP - Google Search">Hikvision SADP</a> tool in the <b>Serial code</b> box (called <b>Security Code</b> in later SADP versions). The camera will compare its internal date and time with the date and time you have entered above. The Serial Number and date much match perfectly or else the code will not work.</div>
</body>
</html>
 
Last edited:
  • Like
Reactions: vasycara and bp2008
catseyenu said:
Did it look anything like this?
Hikvision camera admin password reset tool
Click to expand...

Haha. I do recall, within the past week or so, deleting a user who had just signed up to drive traffic to his site where he had hosted this or a similar tool that offered the same reset method. Not something to deal with the new and more secure method from newer firmwares.
 
  • Like
Reactions: vasycara and catseyenu
I have a rebranded NVR DS-7616NI-E2/8P. After flashing firmware, all my user accounts got corrupted. I can access as admin via GUI on the device without authenticating (just cancel on prompt and get full access). However, web or IVMS doesn't authenticate with the credentials I've created before the flash. Attached is the screenshot of the user menu on the DVR:
ZgtISzK.jpg


Likewise, I cannot change the password for the admin, as the old password isn't accepted. Very screwy. Firmware is 3.4.62 build 160713.
The NVR refuses telnet and SSH.
Master reset steps do get me to the "enter code" scree. However, I can't get Hikvision support. Can this be reset?
 
There have been some posts a while back with the same symptoms, and the way to get round it.
I have a vague recollection it involves going through the list of garbled logon IDs in the web GUI until you find one that works, I think it was with the previous password. I'm not sure what the steps were after that - reset back to defaults, or try changing a password.
I've done a few searches but failed to find the posts I was thinking of.
Perhaps another member will have more info.
 
I've been able to get a reset code from the seller, and have successfully reset the admin password. The user name is still screwed up, however. It's a selection menu in the GUI, so I don't have to type the username in, just the password. Remotely/web/IVMS cannot access as admin because the admin username is not actually "admin." What a pain.
 
And if you do a tftp update with the same firmware that you flashed that didn't correctly translate the configuration file, the result will be configuration reset to defaults.
 
Louiseliu007 can you please help w/ password on this camera? Hik support won't help me as i bought it on ebay. I've tried the online tool here numerous times and it won't reset it.

HAR314-80820161112CCWR673124813WCVU

3.4.75 build 160926

date: 2017 07 22

DSP: v5.0

would hate to just have to trash it
 
  • Like
Reactions: fcolao and RyanODan
bp2008 said:
I've just published a new reset tool that exploits this vulnerabilityto achieve the reset. It should work on firmwares that are too new to use the old reset code method, but old enough to not have this backdoor patched yet.

I've edited the first post of this thread with details and the download link.
Click to expand...

Does your tool recreate an account or just resets the password for an existing one? What do you think it will do for my NVR (Hikvision camera admin password reset tool), assuming the vulnerability is present?
 
sdyfgasd said:
Does your tool recreate an account or just resets the password for an existing one? What do you think it will do for my NVR (Hikvision camera admin password reset tool), assuming the vulnerability is present?
Click to expand...

It calls the command that modifies a user, sending a new password. Worth a try on your NVR. I can't see it breaking anything. If it doesn't work as intended then it will just error-out at the "Get Users" stage.
 
bp2008 said:
I've just published a new reset tool that exploits this vulnerabilityto achieve the reset. It should work on firmwares that are too new to use the old reset code method, but old enough to not have this backdoor patched yet.

I've edited the first post of this thread with details and the download link.
Click to expand...

v5.4.0 160401 - Working

v5.4.0 160520 - Working

v5.4.3 160705 - Working

v5.4.4 161125 - Working

Honestly @bp2008, you've done it again. I can't thank you enough for releasing this. Days of headache and wasted time waiting on password resets. Almost everything before v5.4.5 should reset since it's based off the exploit. I've only came across a few that haven't yet.
 
Last edited:
  • Like
Reactions: bp2008
You must log in or register to reply here.
Top Bottom