Hikvision IPC DS-2CD2112-I reset

With the caveat that I'm unfamiliar with that specific model - usually a backup configuration file is created using an encryption phrase supplied by the user.
In other words, the file doesn't have a fixed decryption key that can be used to extract the plaintext contents.
 
I've bought a second hand DS-2CD2112-I but the problem is that the seller doesn't know the password anymore.
I've tried the "Hikvision Reset Tool" but this doesn't seem to work. There is also no physical reset button.

According the SADP tool:
  • Serial is DS-2CD2112-I0120130408CCRR419639789
  • Date 2004-01-12 20:09:51
  • Software version V4.0.9 Build 130106
  • DSP version V4.0 Build 12128

Is there some way I can do a factory reset or a way to get the security code?

the "<IP>/System/configurationFile?auth=YWRtaW46MTEK" doesn't give any response.
 
Olá bom dia preciso de ajuda..
Preciso redifinir a senha da minhas Cameras IP do moldelo Ds-2cd2112-i
Mais não consigo extrair o arquivo XmL no SADP ela pedi codigo de verificação. poderia me ajudar
 
alastairstevenson said:
What version of firmware does SADP show for the camera?
If it's 5.4.4. or earlier, use this URL to extract the configuration file :
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK
Then zip it up and attach here, and I'll decrypt and decode it and extract the password for you.
Click to expand...
I have looked at the output file from SADP with several editors, Hex editor, Geany and the like, and searched them for the passwords you gave me, to no avail. I have a friend that was able to determine that the password files stored in VMS are stored at the exact same location in memory, every time and so therefore he could go to that location and look at the data, in HEX, and retrieve any password change. Any chance you'd share what you are doing? Even a clue.
 
jrczz said:
I have looked at the output file from SADP with several editors, Hex editor, Geany and the like, and searched them for the passwords you gave me, to no avail.
Click to expand...
That XML file from SADP is a password reset request file and does not hold any passwords, just a signed request code.
When processed by a Hikvision system with their private key, creating a response file, the originating camera authenticates that file with the public key and clears the locally stored password.

jrczz said:
Any chance you'd share what you are doing?
Click to expand...
The configuration files that are exported by the older firmware are reversibly encrypted using a key which can be determined by reverse engineering the firmware, and also subject to a very obvious XOR encode, allowing the password which is stored in plaintext to be exposed.
Normally it should only be possible to export a configuration file if the admin credentials are known - but a serious security vulnerability in many versions of the firmware allows the configuration file to be exported without requiring any credentials.
Hence the admin password - and many other parameters - can be easily found.
 
  • Like
Reactions: jrczz
alastairstevenson said:
What version of firmware does SADP show for the camera?
If it's 5.4.4. or earlier, use this URL to extract the configuration file :
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK
Then zip it up and attach here, and I'll decrypt and decode it and extract the password for you.
Click to expand...
Please help, I'm stuck trying to reset this password at this point not much I can't do. I have attached the config file. Your help will be really appreciated

Thank you
 
you just save my life , I was having so must pressure at work because of this password. One of our NVRs fail so we had to replace it and no one knew the password.

I just try it and it works !!!

I really appreciate your help and to be honest I wasn't expecting such quick reply

Thank you so much !
 
  • Like
Reactions: alastairstevenson
Hello,

I see this thread was started a long time ago but Im having a similar issue. For no apparent reason I was unable to remotely view my Hikvision NVR through the app with an error stating the password was incorrect. I defaulted the NVR and set it up with what should have been the same password but now all of my cams are offline. They do not have a reset button on them and so I cannot get them to default. Can you please take a look and tell me what the password is set to? Attached all 3 of my cameras files. Should be the same password for all but just in case..
 

Attachments

piscopod said:
For no apparent reason I was unable to remotely view my Hikvision NVR through the app with an error stating the password was incorrect.
Click to expand...
One possible cause could be that the NVR was hacked and the password changed if UPnP is enabled on both the NVR and router, or 'port forwarding' is enabled.

piscopod said:
Can you please take a look and tell me what the password is set to?
Click to expand...
Sorry, but these are 'reset request' files that only Hikvision can provide a response file to, they are not configuration files that can be decrypted to reveal a plaintext password.

If the camera has firmware older than 5.4.4, it is usually possible to extract a configuration file by using a backdoor vulnerability.
The method is as follows :

With a PC that has the IP address configured to be in the same range as that of the camera, and on the same network as the camera (this can be on an unused PoE port of an NVR when the camera is also connected to an NVR PoE port), use the URL

http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK

in the browser to attempt to extract a configuration file.
Zip it up and attach here for decryption / decode.
 
  • Like
Reactions: TonyR
alastairstevenson said:
One possible cause could be that the NVR was hacked and the password changed if UPnP is enabled on both the NVR and router, or 'port forwarding' is enabled.


Sorry, but these are 'reset request' files that only Hikvision can provide a response file to, they are not configuration files that can be decrypted to reveal a plaintext password.

If the camera has firmware older than 5.4.4, it is usually possible to extract a configuration file by using a backdoor vulnerability.
The method is as follows :

With a PC that has the IP address configured to be in the same range as that of the camera, and on the same network as the camera (this can be on an unused PoE port of an NVR when the camera is also connected to an NVR PoE port), use the URL

http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK

in the browser to attempt to extract a configuration file.
Zip it up and attach here for decryption / decode.
Click to expand...
thank you. I will get this done in the next few days. Much appreciated.
 
You must log in or register to reply here.
Top Bottom