Hikvision camera admin password reset tool

Hi
I have a NVR DS-7604Ni-E1/4P with 2x Hikvision DS-2CD2342WD-I cameras and don't know the passwords anymore. Could you help me reset them? I have attached the exported files. My only other alternative is to pay a local guy $150 to come out and call Hikvision up. I tried but they won't assist me.
 

Attachments

backjack said:
2x Hikvision DS-2CD2342WD-I cameras
Click to expand...
Have you lost the NVR password as well, or just for the cameras?

What version of firmware is on the cameras?
If you are not sure - connect the PC to an unused NVR PoE port and SADP will show you.
You don't need to change any PC network settings for SADP to work.
 
I know the NVR password. just can't see the camera live view and probably because I can remember the camera password after reseting the NVR.
firmware version of camera areV5.4.0build 160511
 
Last edited:
backjack said:
firmware version of camera areV5.4.0build 160511
Click to expand...
As @saniaowner has indicated - with that version, the backdoor will allow the configuration file to be extracted, which will yield the password.
To use the URL you need to match the PC IP address with the range the camera is using.

What is the IP address of the PC?
What is the IP address of the camera?
Did you change the PC IP address to match the address range the camera is using?
SADP doesn't need the IP addresses to be in the same range.
 
Well I have the laptop connected to a usb to ethernet port converter which via cable is connected to one of the 4 POE ports at the back. The IP address is allocated by the NVR I believe (true)? which is 169.254.121.85 as per picture attached.
The cameras are on two different ranges camera 1 is 10.0.0.101 and camera 2 is 192.168.254.4 (I don't know how I got them like this, could've been the change of router/internet provider which mixed it up)
I can change the PC address? Isn't it auto assigned via NVR?
 

Attachments

  • IMG_1896.jpg
    IMG_1896.jpg
    911.4 KB · Views: 21
backjack said:
I can change the PC address?
Click to expand...
Yes, you have to do that to connect to each camera.
Suggest 10.0.0.150 for connecting to camera 1
And suggest 192.168.254.100 for camera 2
Camera 2 address is typical of the range used by Hikvision NVR PoE ports.
The Camera 1 address seems anomalous - but we can sort that later once you've got the admin password.

backjack said:
Isn't it auto assigned via NVR?
Click to expand...
No - the PC IP address isn't assigned by the NVR. Contrary to popular belief the Hikvision NVR doesn't provide DHCP services.
But it does manage the network configuration of any cameras that's it's been given admin access to.
The 169.254.121.85 address on the PC is a 'self-administered address' that the PC provides for itself when there is no DHCP server, and no static address defined.

OK - when you've set the PC IP address to match each target camera as suggested above, use these URLs



Hopefully you will get 2 configuration files, which you can zip up and attach here.
 
Well done.

The admin password for the 10. HIKVISION DS-2CD2342WD-I - 60347540 camera is
BONAvista21

The admin password for the 192. Front HIKVISION DS-2CD2342WD-I - 603474792 camera is
BONAvista21
 
  • Like
Reactions: gwminor48
alastairstevenson said:
Well done.

The admin password for the 10. HIKVISION DS-2CD2342WD-I - 60347540 camera is
BONAvista21

The admin password for the 192. Front HIKVISION DS-2CD2342WD-I - 603474792 camera is
BONAvista21
Click to expand...

Hey Alistair,

Could you let me know what the file format is and how you are decoding it? When I look at the config files they appear binary.
 
coolbloke1324 said:
Hey Alistair,

Could you let me know what the file format is and how you are decoding it? When I look at the config files they appear binary.
Click to expand...

Alternative option

Hikvision backdoor IP camera

Hello With the help of Mr. alastairstevenson and a few instructions ( WormChickenWizard/hikvision-xor-decrypter), I managed to create a tool a few months ago to reset the password of Hikvision IP cameras with firmware 5.4.4 and below. I was a little surprised when I noticed that this tool has...
ipcamtalk.com ipcamtalk.com
 
coolbloke1324 said:
Could you let me know what the file format is and how you are decoding it? When I look at the config files they appear binary.
Click to expand...
They are XOR encoded with 0x738b5544 then encrypted with the aes-128 ecb cipher.
But the original file is still binary.
It's only in later firmware a SQLlite database format is used.

Check out this post from a couple of years ago :

Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

i used this command to extract the dav file test@test-VirtualBox:~$ ./hikpack -t k41 -i digicap.dav -o contents Magic : 484b5753 hdr_crc : 00001d1a (OK) lang_id : 00000001 date_hex: 20150315 devclass: 00000043 File: cramfs.img, CRC OK WARN: missing new_20.bin trailer file Extra tail at the end...
ipcamtalk.com ipcamtalk.com
 
Hey folks, based on various posts here and some others I found online I was able to code a quick terminal program that will do everything for you if you provide it with the IP address of a camera on your network:

github.com

GitHub - Irrelon/hikvision-password-extractor: Extract passwords from your Hikvision devices so you don't have to rely on Hikvision for a password reset.

Extract passwords from your Hikvision devices so you don't have to rely on Hikvision for a password reset. - Irrelon/hikvision-password-extractor
github.com github.com

It requires Node.js to be installed. If there is any demand for it I could fairly easily create a cross-platform app that would do the same thing with a GUI but figured if you are here searching for help you probably already have a basic understanding of networking and command line tools :)

I have only tested this on MacOS and Node.js 13.7.0. If you run into issues on other platforms let me know.

Hope this helps someone else like it just helped me get access to my NVR again! :)

Cheers.
 
Last edited:
  • Like
Reactions: Oleglevsha, SamM and alastairstevenson
coolbloke1324 said:
I have only tested this on MacOS and Node.js 13.7.0. If you run into issues on other platforms let me know.

Hope this helps someone else like it just helped me get access to my NVR again! :)

Cheers.
Click to expand...
Hi

Thanks for the effort. Works well.

Do you have MacOS method to flash the firmware to 5.4 for those newer models?
 
SamM said:
Hi

Thanks for the effort. Works well.

Do you have MacOS method to flash the firmware to 5.4 for those newer models?
Click to expand...
Hey, no I don't sorry. I haven't looked into firmware flashing much at all for hikvision cameras. I actually dabble in SOC development but I haven't specifically messed around with hikvision hardware (yet :p).
 
  • Like
Reactions: alastairstevenson
Hi everyone,

I have a NVR DS-7608NI-K2/8P with 4x DS-2CD2645FWD-IZS. One of the cameras seems to be used before in an different network so I can't get access to it.

The camera starting time is 1970-01-07 01:16:00 and runs on Firmware V5.6.2. does anyone know how I could reset the password for the camera? By using the password reset tool I can generate a key which brings me to error 2022. So any help would be perfect. Thanks!!
 
I may be wrong - but doesn't that camera have a reset button at the SD card slot?
If so, press before power on and keep pressed for about 30 seconds after power on.
Then it should be in an 'Inactive' state.
 
  • Like
Reactions: Oliver010
alastairstevenson said:
I may be wrong - but doesn't that camera have a reset button at the SD card slot?
If so, press before power on and keep pressed for about 30 seconds after power on.
Then it should be in an 'Inactive' state.
Click to expand...
Actually I don't know that. The camera is mounted at 6 meters so I can't a have a short look. But I will check the manual :)
 
You must log in or register to reply here.
Top Bottom