NVR HNR51P6-16 and NC304-XD Turret Cameras System Reset and Cannot add Cameras

Trinergy

Trinergy

n3wb
May 6, 2020
25
1
Philadelphia, PA
Hello,

I recently reset the NVR because we did not have the password. Hikvision says its not theirs or from this region "RR" in the serial code. So the reset worked but now the cameras are still using the old password and are offline. I tried to take apart a camera but they had no reset button. Furthermore, I have turned on virtual host but when I try to access the provided link in the NVR it times out and fails. I even tried using the password hack tool with the port numbers but that did not work either. Any thoughts on what else I can do? I did find two XML files labeled IPCAM on a PC one with the model # of the cameras in back to 2017 and another with a date stamp. I tried to import them but the NVR was looking for an XLS file (really weird) for the cameras. I have attached them here. I could only get the buttons to work in IE 11.

I keep hitting a road block every time I think I get further. Like how does a camera not have a reset button?

Any help would be appreciated.
 

Attachments

Trinergy said:
now the cameras are still using the old password and are offline.
Click to expand...
Assuming these are really Hikvision OEM cameras -
Connect the PC to an unused NVR PoE port and use SADP to see the camera firmware version.
If you are lucky, it may be old enough to have the backdoor vulnerability, which can be used to extract the password.

SADP Tool

Locate Hikvision brand cameras within the same network, including their IP address and port.
ipcamtalk.com ipcamtalk.com
 
  • Like
Reactions: Mike
It say's v5.4.4build 170123 and both reset tools did not work. SADP reports: NC304-XD20170527BBWR768992912 and camera has 768992912. I assumed the latter is the actual serial number which is what I used in the web page tool.

I assume I SOL unless I goofed up the serial #? Since there is no other password reset. Is it possible to send my key to Chinese or Europe support address? since the camera is a WR version? Is there another Worldwide location where I can send the password reset to other than US?
 
Last edited:
post a screen shot of the SADP listings and some pictures of one of the cams including any identifying labels or markings...
you may be able to flash firmware onto the cams via TFTP, which would reset them, but need to make sure to use the right firmware.
if you take a packet capture using Wireshark while one of the cam's is booting up, you'll see it ARP'ing for 192.0.0.128 (from 192.0.0.64)
which means it's looking for a TFTP server to grab firmware from...
 
Thanks. Attached the pics. Downloading and installing wireshark now.
 

Attachments

  • sadp.png
    sadp.png
    13.4 KB · Views: 12
  • cam.jpg
    cam.jpg
    233.3 KB · Views: 9
  • cam2.jpg
    cam2.jpg
    342.8 KB · Views: 13
  • Like
Reactions: Trinergy
A couple of things :
Trinergy said:
It say's v5.4.4build 170123 and both reset tools did not work.
Click to expand...
Do all the cameras have the same version, are there any older than that?
If so - they will have the backdoor vulnerability that allows password extraction.

That version of firmware is marginal for having the backdoor vulnerability, especially if it's an OEM model.
Worth trying, easy enough to do :
Connect the PC to an unused NVR PoE port, change the PC IP address to, say, 192.168.254.200 and try this URL in the browser -
See if it yields a configuration file without asking for logon credentials.

On the wireshark capture - could it be that the Windows firewall or a network AV is blocking the camera inbound probes?
Maybe try with the firewall disabled temporarily.

On the Hikvision tftp updater - it's unreliable when the camera is powered with PoE, the timing can be marginal.
Do you have the chance to try it with a 12v external supply?
Also it's best when both camera and PC are wired to a switch or router as opposed to being directly connected, again a timing issue.
 
I had the firewall off and plugged into to a switch with the camera directly on a POE port. I only have a POE injector outside of my switch to power it. Let me see if there are any other power supplys around that can fit and provide 12v.

I will have to try getting someone to plug the PC onto the NVR today as I am remote.

Thanks again.

Sent from my SM-G975U using Tapatalk
 
Trinergy said:
I had the firewall off and plugged into to a switch with the camera directly on a POE port.
Click to expand...
Sorry, but I don't quite follow.
The camera was connected as normal to an NVR PoE port? If so - how was the PC connected?
Or the camera and PC were both plugged in to a PoE switch?
 
alastairstevenson said:
A couple of things :

Do all the cameras have the same version, are there any older than that?
If so - they will have the backdoor vulnerability that allows password extraction.

That version of firmware is marginal for having the backdoor vulnerability, especially if it's an OEM model.
Worth trying, easy enough to do :
Connect the PC to an unused NVR PoE port, change the PC IP address to, say, 192.168.254.200 and try this URL in the browser -
See if it yields a configuration file without asking for logon credentials.

On the wireshark capture - could it be that the Windows firewall or a network AV is blocking the camera inbound probes?
Maybe try with the firewall disabled temporarily.

On the Hikvision tftp updater - it's unreliable when the camera is powered with PoE, the timing can be marginal.
Do you have the chance to try it with a 12v external supply?
Also it's best when both camera and PC are wired to a switch or router as opposed to being directly connected, again a timing issue.
Click to expand...

I am going to have someone plug in a PC into the NVR to check.

I tried the link and it just gave me a login prompt that said "Your Connection is Not Secure".

I had the firewall off as well as my AV (Forticlient).

I tried again with a 12v Netgear switch power supply but the same result no TFTP nor did it search for .128.
 

Attachments

  • firewall.png
    firewall.png
    34.3 KB · Views: 3
Trinergy said:
I tried the link and it just gave me a login prompt that said "Your Connection is Not Secure".
Click to expand...
Just a warning, for this purpose can be ignored.
But that URL can only work if the PC is on the same network as the cameras - on an unused NVR PoE port.

Trinergy said:
I tried again with a 12v Netgear switch power supply but the same result no TFTP nor did it search for .128.
Click to expand...
With both the PC and camera wired to the switch?
 
All of the cameras have the same build in the SADPtool. A few have H in front of the model name. I will try the link on every camera.
 

Attachments

  • sadp.png
    sadp.png
    76.8 KB · Views: 6
Trinergy said:
Confirmed none of them seem vulnerable to the backdoor.
Click to expand...
Ah, that's a pity. It looks like they have just crept over the version threshold for the fix.
It would have been a quick fix for the password problem.

And it seems the tftp updater doesn't want to play with the camera is on a 12v power supply, both PC and camera wired to a switch, no firewall on the PC - and wireshark not showing any probes from the camera.

But that is a bit odd as I'd have expected to see an ARP for 192.0.0.128 in preparation for the UDP probe in your wireshark capture in post #9.
 
TFTP updater was on same switch with laptop running on either POE or 12v with no firewall or AV on laptop and Wireshark not showing any probes from the camera. I sorted by ARP requests in Wireshark and nothing except the rest of my devices on the network.

Tell me about it. I was so excited to find this site. I wish I found it before I reset the NVR. Not that mattered. It did not look like there was a way to change the camera passwords without knowing the nvr password. We only had the "pattern" lock password. I guess we got a lot of bricks now.
 
You must log in or register to reply here.
Top Bottom