Hikvision camera admin password reset tool

slipkn0t

n3wb
Joined
Jan 21, 2022
Messages
1
Reaction score
0
Location
New York
Hello guys,
Hope everyone is doing well.
If someone could help me crack the password in this config file, it would help me out a lot.

Thanks in advance!
 

Attachments

CyJackX

n3wb
Joined
Sep 30, 2021
Messages
6
Reaction score
1
Location
America
Volunteering to help unlock the cameras in my co-op building. The vendor installed them in 2015 and has been unable to help us with the right password(s), so I have to go the route of resetting the passwords.
Unfortunately, Hikvision responded to the XML file I got using SADP with: "The serial number(s) that have been provided for the device(s) is either NOT from the North American Region, products purchased outside of our Region, purchased from unauthorized distributor(s) (Such as eBay, or Amazon), or simply not Hikvision products. "

I do not know where the vendor acquired the cameras.
Build is 5.3.0 150513
DS-2CD2132F-I20150721CCWR530912512 is what I've been using with the Password Reset Tool, although I also tried it without the model#, and it still times out.
Haven't been able to get the Password Reset Tool here or the downloaded backdoor .exe to work. Can't even find a spot labeled Security Code or Serial Code, clicking "Forgot Password" leads to this:
1646975468792.png
I tried entering the codes given by the password reset tool into the spot beneath Import File, but it doesn't seem to work. And I can't change the mode up top either.
 
Last edited:

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Unfortunately, Hikvision responded to the XML file I got using SADP with: "The serial number(s) that have been provided for the device(s) is either NOT from the North American Region, products purchased outside of our Region, purchased from unauthorized distributor(s) (Such as eBay, or Amazon), or simply not Hikvision products. "
So unhelpful.
It probably took them almost as long to respond in that way as to provide the reset code.

However - with that version of firmware it should be possible to extract the camera password using the Hikvision 'backdoor vulnerability'.
Use this URL in the browser, replacing the IP address with that of the camera.
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK

It should extract a configuration file.
Zip it up and attach here and we can decrypt and decode it to extract the password.
 

CyJackX

n3wb
Joined
Sep 30, 2021
Messages
6
Reaction score
1
Location
America
So unhelpful.
It probably took them almost as long to respond in that way as to provide the reset code.

However - with that version of firmware it should be possible to extract the camera password using the Hikvision 'backdoor vulnerability'.
Use this URL in the browser, replacing the IP address with that of the camera.
http://<camera_IP_address>/System/configurationFile?auth=YWRtaW46MTEK

It should extract a configuration file.
Zip it up and attach here and we can decrypt and decode it to extract the password.
Hey Alastair, thanks for your help. Unfortunately, it seems to be timing out still:
1647012382993.png

This is the IP address I'm plugging in from SADP for this camera. Our system is closed loop and not connected to the internet, FWIW.
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
This is the IP address I'm plugging in from SADP for this camera. Our system is closed loop and not connected to the internet, FWIW.
The IP address as shown in your screenshot (192.168.254.10) suggests the camera is on a Hikvision NVR PoE port.
SADP will find Hikvision devices even when they are on different IP address ranges than the PC it's running on, when the PC is connected to an unused NVR PoE port.
But for browser access - the PC IP address needs to be in the same range as the camera.

So to get this method to work, you will need to temporarily manually change the PC IP address to a static value in the same range as the camera, such as 192.168.254.100
That should work OK.
 

CyJackX

n3wb
Joined
Sep 30, 2021
Messages
6
Reaction score
1
Location
America
The IP address as shown in your screenshot (192.168.254.10) suggests the camera is on a Hikvision NVR PoE port.
SADP will find Hikvision devices even when they are on different IP address ranges than the PC it's running on, when the PC is connected to an unused NVR PoE port.
But for browser access - the PC IP address needs to be in the same range as the camera.

So to get this method to work, you will need to temporarily manually change the PC IP address to a static value in the same range as the camera, such as 192.168.254.100
That should work OK.
Interesting; The camera is plugged into a TP-Link POE injector connected to my laptop. Will try in a few.
 

kspmtrp

n3wb
Joined
Mar 7, 2022
Messages
3
Reaction score
1
Location
Spain
Is there a way to reset the password of a WiFi only camera model? It is not connected to any network, so it doesn't have an IP. I need to enter to the "Wifi Access Point" created by the camera (HAP_xxxxxx), but I don't know the password.
 

CyJackX

n3wb
Joined
Sep 30, 2021
Messages
6
Reaction score
1
Location
America
The IP address as shown in your screenshot (192.168.254.10) suggests the camera is on a Hikvision NVR PoE port.
SADP will find Hikvision devices even when they are on different IP address ranges than the PC it's running on, when the PC is connected to an unused NVR PoE port.
But for browser access - the PC IP address needs to be in the same range as the camera.

So to get this method to work, you will need to temporarily manually change the PC IP address to a static value in the same range as the camera, such as 192.168.254.100
That should work OK.
Hey Alastair, after setting a static IP, the downloaded HikVisionPasswordResetHelper.exe was able to reset the password. Thanks for your advice, couldn't have done it without you (and a little Googling on how to set DNS!)
 

digiteltlc

Young grasshopper
Joined
Sep 23, 2016
Messages
37
Reaction score
7
Is it possible to unlock cameras with firmware 5.4.5 build 170124 other thank Hikvision genuine procedure ?
Thank you
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,930
Reaction score
6,778
Location
Scotland
Is it possible to unlock cameras with firmware 5.4.5 build 170124 other thank Hikvision genuine procedure ?
On the assumption that you mean 'other than by contacting Hikvision for a reset code'.
Depending on the (unspecified) camera model -
It may have a reset button which can be used to reset to factory default settings.
It might be a model that suffers from this vulnerability :

But usually, the Hikvision tftp updater is as easy a method as any to reset to factory default values.
 

Twotone2

n3wb
Joined
Apr 23, 2021
Messages
1
Reaction score
0
Location
Glasgow
Hi guys I've just bought a HIK-Vision DS-KB8113-IME1 doorbell cam and can't get it onto my network.

I have used the SADP TOOL which shows the IP address of the camera but I can't change the IP settings 192.0.0.65 because I don't have the admin password and I can't open a web browser either with that IP address I've tried internet explorer mode in Edge but still not able to access the web browser.

I have sent the XML file below to HIK vision UK support but that was yesterday just wondering if anyone can provide an admin password so that I can get this thing to work.

Thanks

Tony
 

Attachments

RAMCO

n3wb
Joined
Jun 18, 2022
Messages
13
Reaction score
4
Location
Texas
I just picked up some private label Hikvision dome cameras. They say INC-MP20V on a sticker for the model number and internet searches indicate the company as ILDVR.
SAPD is seeing them and reporting them as DS-2CD852MF with a serial number starting with IMC-MP20Vxxx... here is one of the serials:

INC-MP20V0020110915BCWR270620411WC

They are V2.0build 110718

The "manual" is a subset of the Hikvision manual.
I used the tool on here to get the reset code, using the SADP tool / forgot password I am getting a message password recovered with a green check. The manual indicates the default admin pwd is 12345. However when trying to reset the IP via the SADP tool using 12345 after doing the password recovery it times out.
Attached is a screen shot of the web page I get when connecting to the camera.
Using admin / 12345 or root / 12345 it does nothing when I press either logon or reset.
Any ideas?
 

Attachments

RAMCO

n3wb
Joined
Jun 18, 2022
Messages
13
Reaction score
4
Location
Texas
I just picked up some private label Hikvision dome cameras. They say INC-MP20V on a sticker for the model number and internet searches indicate the company as ILDVR.
SAPD is seeing them and reporting them as DS-2CD852MF with a serial number starting with IMC-MP20Vxxx... here is one of the serials:

INC-MP20V0020110915BCWR270620411WC

They are V2.0build 110718

The "manual" is a subset of the Hikvision manual.
I used the tool on here to get the reset code, using the SADP tool / forgot password I am getting a message password recovered with a green check. The manual indicates the default admin pwd is 12345. However when trying to reset the IP via the SADP tool using 12345 after doing the password recovery it times out.
Attached is a screen shot of the web page I get when connecting to the camera.
Using admin / 12345 or root / 12345 it does nothing when I press either logon or reset.
Any ideas?
Progress, found the thread mentioning the Hikvision portal, went there and downloaded an earlier version of SADP and am able to modify the network parameters using pwd 12345. Still cannot access the web portal of the cam but am wondering if it uses flash and W10 does not have that anymore...
 

RAMCO

n3wb
Joined
Jun 18, 2022
Messages
13
Reaction score
4
Location
Texas
Progress, found the thread mentioning the Hikvision portal, went there and downloaded an earlier version of SADP and am able to modify the network parameters using pwd 12345. Still cannot access the web portal of the cam but am wondering if it uses flash and W10 does not have that anymore...
Am able to add to BI using admin / 12345. Now to figure out how to access the camera web front end... Has excellent picture...
 
Top