Hikvision (clone?) camera unable to reset password

[rawinek]

Hi everyone. I have a Hikvision camera from a demolished building. It has some random branding on it, however it's detected by SADP tool.

Device Type: HD-IPCAMERA
Device Serial No.: HD-IPCAMERA0120121218FXSH271314570
Software Version: V4.0.3build 121010
DSP Version: V4.0, build 120918
Start Time: 2006-01-01 00:00:11

The thing is that I'm not able to restore default password neither using SADP recovery, nor HikPasswordHelper tool from bp2008. With SADP I've tried a few combinations of serial number and used Start Time date, but no luck.

Does anyone have a clue what can be the issue here?

 

[alastairstevenson]

As a long shot - maybe try this in a browser, and see if it extracts a file :

http://192.168.1.120/System/configurationFile?auth=YWRtaW46MTEK

 

[rawinek]

As a long shot - maybe try this in a browser, and see if it extracts a file :

http://192.168.1.120/System/configurationFile?auth=YWRtaW46MTEK

Unfortunately no luck. Error 404 received.

 

[iTuneDVR]

Device Type: HD-IPCAMERA
Device Serial No.: HD-IPCAMERA0120121218FXSH271314570
Software Version: V4.0.3build 121010
DSP Version: V4.0, build 120918
Start Time: 2006-01-01 00:00:11

If it realy old ipc, so use this reset code for 2006-01-01
RdQRQQzzRq
If not, try to other start time or get dump, and it possible to get password from it.

 

[rawinek]

If it realy old ipc, so use this reset code for 2006-01-01
RdQRQQzzRq
If not, try to other start time or get dump, and it possible to get password from it.

That code doesn't work.

I tested codes for the start time 2006-01-01 and SNs: HD-IPCAMERA0120121218FXSH271314570, IPCAMERA0120121218FXSH271314570, 0120121218FXSH271314570, FXSH271314570, 271314570. All tries failed.

What other start time should I use? Is there any pattern for that if the one provided by SADP doesn't work?

 

[iTuneDVR]

Try get dump or try use bashis_tools for hik ipc & get config file or remove it or connect to ttls and get console access

 

[rawinek]

Try get dump or try use bashis_tools for hik ipc & get config file or remove it or connect to ttls and get console access

Do you know by any chance if that process is described anywhere on this board?

 

[iTuneDVR]

Do you know by any chance if that process is described anywhere on this board?

About ttl or test tool?
Share your ipc to test tool.

 

[rawinek]

About ttl or test tool?
Share your ipc to test tool.

I would like to know how to make a dump. When it comes to bashis_tools I was able to find only a tool written in Python for Dahua devices, not for Hikvision.

Is there any step by step process described what should I do to extract the current password or reset the camera to factory defaults if the methods described in the original post don't work?

 

[iTuneDVR]

I would like to know how to make a dump. When it comes to bashis_tools I was able to find only a tool written in Python for Dahua devices, not for Hikvision.

PoC/CVE-2021-36260.py at master · mcw0/PoC

Issues has been disabled for these PoC's, as they are simply PoC, Public Domain and unsupported. - mcw0/PoC

github.com

if not, open your ipc, connect it via ttl2usb adapter to your pc, stop boot start, ....

 

[iTuneDVR]

Possible, if this ipc is really old use telnet with root access

 

[iTuneDVR]

or ipv6 tricks