Hikvision camera admin password reset tool

[backjack]

Hi
I have a NVR DS-7604Ni-E1/4P with 2x Hikvision DS-2CD2342WD-I cameras and don't know the passwords anymore. Could you help me reset them? I have attached the exported files. My only other alternative is to pay a local guy $150 to come out and call Hikvision up. I tried but they won't assist me.

 

[alastairstevenson]

2x Hikvision DS-2CD2342WD-I cameras

Have you lost the NVR password as well, or just for the cameras?

What version of firmware is on the cameras?
If you are not sure - connect the PC to an unused NVR PoE port and SADP will show you.
You don't need to change any PC network settings for SADP to work.

 

[backjack]

I know the NVR password. just can't see the camera live view and probably because I can remember the camera password after reseting the NVR.
firmware version of camera areV5.4.0build 160511

 

[alastairstevenson]

firmware version of camera areV5.4.0build 160511

As @saniaowner has indicated - with that version, the backdoor will allow the configuration file to be extracted, which will yield the password.
To use the URL you need to match the PC IP address with the range the camera is using.

What is the IP address of the PC?
What is the IP address of the camera?
Did you change the PC IP address to match the address range the camera is using?
SADP doesn't need the IP addresses to be in the same range.

 

[backjack]

Well I have the laptop connected to a usb to ethernet port converter which via cable is connected to one of the 4 POE ports at the back. The IP address is allocated by the NVR I believe (true)? which is 169.254.121.85 as per picture attached.
The cameras are on two different ranges camera 1 is 10.0.0.101 and camera 2 is 192.168.254.4 (I don't know how I got them like this, could've been the change of router/internet provider which mixed it up)
I can change the PC address? Isn't it auto assigned via NVR?

 

[alastairstevenson]

I can change the PC address?

Yes, you have to do that to connect to each camera.
Suggest 10.0.0.150 for connecting to camera 1
And suggest 192.168.254.100 for camera 2
Camera 2 address is typical of the range used by Hikvision NVR PoE ports.
The Camera 1 address seems anomalous - but we can sort that later once you've got the admin password.

Isn't it auto assigned via NVR?

No - the PC IP address isn't assigned by the NVR. Contrary to popular belief the Hikvision NVR doesn't provide DHCP services.
But it does manage the network configuration of any cameras that's it's been given admin access to.
The 169.254.121.85 address on the PC is a 'self-administered address' that the PC provides for itself when there is no DHCP server, and no static address defined.

OK - when you've set the PC IP address to match each target camera as suggested above, use these URLs

http://10.0.0.101/System/configurationFile?auth=YWRtaW46MTEK

http://192.168.254.4/System/configurationFile?auth=YWRtaW46MTEK

Hopefully you will get 2 configuration files, which you can zip up and attach here.

 

[backjack]

Legends! You were right. Thanks. You learn something new every day

two files attached

 

[alastairstevenson]

Well done.

The admin password for the 10. HIKVISION DS-2CD2342WD-I - 60347540 camera is
BONAvista21

The admin password for the 192. Front HIKVISION DS-2CD2342WD-I - 603474792 camera is
BONAvista21

 

[coolbloke1324]

Well done.

The admin password for the 10. HIKVISION DS-2CD2342WD-I - 60347540 camera is
BONAvista21

The admin password for the 192. Front HIKVISION DS-2CD2342WD-I - 603474792 camera is
BONAvista21

Hey Alistair,

Could you let me know what the file format is and how you are decoding it? When I look at the config files they appear binary.

 

[saniaowner]

Hey Alistair,

Could you let me know what the file format is and how you are decoding it? When I look at the config files they appear binary.

Alternative option

Hikvision backdoor IP camera

Hello With the help of Mr. alastairstevenson and a few instructions ( WormChickenWizard/hikvision-xor-decrypter), I managed to create a tool a few months ago to reset the password of Hikvision IP cameras with firmware 5.4.4 and below. I was a little surprised when I noticed that this tool has...

ipcamtalk.com

 

[alastairstevenson]

Could you let me know what the file format is and how you are decoding it? When I look at the config files they appear binary.

They are XOR encoded with 0x738b5544 then encrypted with the aes-128 ecb cipher.
But the original file is still binary.
It's only in later firmware a SQLlite database format is used.

Check out this post from a couple of years ago :

Hikvision FIRMWARE TOOLS - change language, extract files and create own firmware

i used this command to extract the dav file test@test-VirtualBox:~$ ./hikpack -t k41 -i digicap.dav -o contents Magic : 484b5753 hdr_crc : 00001d1a (OK) lang_id : 00000001 date_hex: 20150315 devclass: 00000043 File: cramfs.img, CRC OK WARN: missing new_20.bin trailer file Extra tail at the end...

ipcamtalk.com

 

[coolbloke1324]

Hey folks, based on various posts here and some others I found online I was able to code a quick terminal program that will do everything for you if you provide it with the IP address of a camera on your network:

GitHub - Irrelon/hikvision-password-extractor: Extract passwords from your Hikvision devices so you don't have to rely on Hikvision for a password reset.

Extract passwords from your Hikvision devices so you don't have to rely on Hikvision for a password reset. - Irrelon/hikvision-password-extractor

github.com

It requires Node.js to be installed. If there is any demand for it I could fairly easily create a cross-platform app that would do the same thing with a GUI but figured if you are here searching for help you probably already have a basic understanding of networking and command line tools

I have only tested this on MacOS and Node.js 13.7.0. If you run into issues on other platforms let me know.

Hope this helps someone else like it just helped me get access to my NVR again!

Cheers.

 

[SamM]

I have only tested this on MacOS and Node.js 13.7.0. If you run into issues on other platforms let me know.

Hope this helps someone else like it just helped me get access to my NVR again!

Cheers.

Hi

Thanks for the effort. Works well.

Do you have MacOS method to flash the firmware to 5.4 for those newer models?

 

[coolbloke1324]

Hi

Thanks for the effort. Works well.

Do you have MacOS method to flash the firmware to 5.4 for those newer models?

Hey, no I don't sorry. I haven't looked into firmware flashing much at all for hikvision cameras. I actually dabble in SOC development but I haven't specifically messed around with hikvision hardware (yet ).

 

[Oliver010]

Hi everyone,

I have a NVR DS-7608NI-K2/8P with 4x DS-2CD2645FWD-IZS. One of the cameras seems to be used before in an different network so I can't get access to it.

The camera starting time is 1970-01-07 01:16:00 and runs on Firmware V5.6.2. does anyone know how I could reset the password for the camera? By using the password reset tool I can generate a key which brings me to error 2022. So any help would be perfect. Thanks!!

 

[alastairstevenson]

I may be wrong - but doesn't that camera have a reset button at the SD card slot?
If so, press before power on and keep pressed for about 30 seconds after power on.
Then it should be in an 'Inactive' state.

 

[Oliver010]

I may be wrong - but doesn't that camera have a reset button at the SD card slot?
If so, press before power on and keep pressed for about 30 seconds after power on.
Then it should be in an 'Inactive' state.

Actually I don't know that. The camera is mounted at 6 meters so I can't a have a short look. But I will check the manual

 

[alastairstevenson]

But I will check the manual

It says 'Reset button - yes'

 

[Oliver010]

It says 'Reset button - yes'

That’s perfect. Sorry for the question Will this reset the password too? Just to be sure...

 

[alastairstevenson]

Will this reset the password too?

No default passwords on that firmware.
It will set the camera into an 'Inactive' state, that requires you to create your own strong password to 'Activate' it.
This is done easily using SADP, or via the web GUI.