Hikvision (clone?) camera unable to reset password

R

rawinek

n3wb
Aug 12, 2021
6
0
Poland
Hi everyone. I have a Hikvision camera from a demolished building. It has some random branding on it, however it's detected by SADP tool.

Device Type: HD-IPCAMERA
Device Serial No.: HD-IPCAMERA0120121218FXSH271314570
Software Version: V4.0.3build 121010
DSP Version: V4.0, build 120918
Start Time: 2006-01-01 00:00:11

The thing is that I'm not able to restore default password neither using SADP recovery, nor HikPasswordHelper tool from bp2008. With SADP I've tried a few combinations of serial number and used Start Time date, but no luck.

Does anyone have a clue what can be the issue here?

1635930507171.png

1635930455745.png
 
rawinek said:
Device Type: HD-IPCAMERA
Device Serial No.: HD-IPCAMERA0120121218FXSH271314570
Software Version: V4.0.3build 121010
DSP Version: V4.0, build 120918
Start Time: 2006-01-01 00:00:11
Click to expand...
If it realy old ipc, so use this reset code for 2006-01-01
RdQRQQzzRq
If not, try to other start time or get dump, and it possible to get password from it.
 
iTuneDVR said:
If it realy old ipc, so use this reset code for 2006-01-01
RdQRQQzzRq
If not, try to other start time or get dump, and it possible to get password from it.
Click to expand...

That code doesn't work.

I tested codes for the start time 2006-01-01 and SNs: HD-IPCAMERA0120121218FXSH271314570, IPCAMERA0120121218FXSH271314570, 0120121218FXSH271314570, FXSH271314570, 271314570. All tries failed.

What other start time should I use? Is there any pattern for that if the one provided by SADP doesn't work?
 
Try get dump or try use bashis_tools for hik ipc & get config file or remove it or connect to ttls and get console access
 
Last edited:
iTuneDVR said:
About ttl or test tool?
Share your ipc to test tool.
Click to expand...

I would like to know how to make a dump. When it comes to bashis_tools I was able to find only a tool written in Python for Dahua devices, not for Hikvision.

Is there any step by step process described what should I do to extract the current password or reset the camera to factory defaults if the methods described in the original post don't work?
 
rawinek said:
I would like to know how to make a dump. When it comes to bashis_tools I was able to find only a tool written in Python for Dahua devices, not for Hikvision.
Click to expand...
github.com

PoC/CVE-2021-36260.py at master · mcw0/PoC

Issues has been disabled for these PoC's, as they are simply PoC, Public Domain and unsupported. - mcw0/PoC
github.com github.com

if not, open your ipc, connect it via ttl2usb adapter to your pc, stop boot start, ....
 
You must log in or register to reply here.
Top Bottom