Hikvision NVR password reset

JCamNet

n3wb
Joined
Jul 25, 2022
Messages
2
Reaction score
1
Location
United States
Hello everyone!

I recently purchased a used Hikvision NVR on ebay and the previous owner did not factory reset it before shipping it. The problem is that I purchased it from a reseller and they didn't have the password from the previous owner either. I ended up getting a full refund because hikvision wouldn't help me because ebay isn't an authorized dealer. I would still like to use the NVR and I've tried using the password reset code generator and I also tried using the downloadable tool to try and use the exploit to reset the password, neither of those worked. I checked the motherboard and do not see a reset switch. I'm not 100% sure which jumpers to short because I couldn't find J1/2 on the board (maybe I'm just blind! lol) I've attached images of the motherboard and the alarm board. If anyone has any suggestions I would greatly appreciate it!

NVR details.
DS-7616NI-I2/16P
Software version: 4.50.01 build 210322
DSP version V5.0 build 210318
 

Attachments

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,123
Reaction score
5,985
Location
Scotland
I checked the motherboard and do not see a reset switch. I'm not 100% sure which jumpers to short
There isn't a reset switch, and I'm not aware of any reset jumpers on that model.

Here are 3 ways to reset to factory defaults :

The classic tftp firmware updater method - but not using the Hikvision tftp updater as the firmware is larger than its 32MB filesize limit.
Scott Lamb's Python2-based tftp updater clone would work, if the NVR bootloader still has the tftp update facility built in.

Use the same version of firmware, downloaded from here :

Then there is the 'trojan horse' method, which I've used loads of times for used NVRs bought off eBay.
You need a Hikvision camera that's running firmware 3.4.0 (* edit 5.4.0 *)or earlier so it has the 'backdoor vulnerability'.
In summary - reset the camera to defaults so it's 'Inactive', connect it to an NVR PoE port so the NVR 'Activates' it, by default with the NVR admin password, pull a copy of the camera configuration file via the backdoor (no authentication needed ...), decrypt and decode the file to yield a plaintext admin password.
Example -

And you can use the device serial console to do a firmware update via a normal tftp server, which resets to defaults.
But that's a bit more complicated to set up the environment to do it.
 
Last edited:

trempa92

Getting the hang of it
Joined
Mar 26, 2020
Messages
230
Reaction score
52
Location
Croatia,Zagreb
Holly crap, a free 16channel I-serie NVR :D Did u just share how to scam ebay to get refund for hikvision devices and keep them?
 
Top