Skip to content

Instantly share code, notes, and snippets.

@gabonator
Last active July 3, 2024 07:22
Show Gist options
  • Save gabonator/74cdd6ab4f733ff047356198c781f27d to your computer and use it in GitHub Desktop.
Save gabonator/74cdd6ab4f733ff047356198c781f27d to your computer and use it in GitHub Desktop.
HiSilicon IP camera root passwords
Summary of passwords by sperglord8008s, updated November 1. 2020. For login try "root", "default", "defaul" or "root"
00000000
059AnkJ
4uvdzKqBkj.jg
7ujMko0admin
7ujMko0vizxv
123
1111
1234
1234qwer
2601hx
12345
54321
123456
666666
888888
1111111
/*6.=_ja
anko
anni2013
annie2012
avtech97
cat1029
ccadmin
cxlinux
default
dreambox
fxjvt1805
hdipc%No
hi3518
hichiphx
hipc3518
hkipc2016
hslwificam
ikwb
ipc71a
IPCam@sw
ivdev
juantech
jvbzd
jvtsmart123
klv123
klv1234
meinsm
OxhlwSG8
pass
password
realtek
root
hi3518
S2fGqNFs
service
smcadmin
supervisor
support
system
tech
tlJwpbo6
ubnt
user
vhd1206
vizxv
xc3511
xmhdipc
zlxx.
Zte521
@Arnaud30
Copy link

It's actually quite simple, I advise you to try it.
You just need a module like this
https://aliexpress.com/item/1005001545513477.html

@Arnaud30
Copy link

Otherwise, try to obtain the firmware binary, we can modify it to skip the password

@Osirismix
Copy link

@Arnaud30 so i orderd this device, it will be around 10 of june :D
How to obtain firmware binary?

@Arnaud30
Copy link

Alright.
In the meantime, you need to identify the flash memory circuit.
I think the component is on the other side of the pcb
Take it apart and post a photo
Install 3 wires on the UART port of your card (I put a male connector on the PCB, to be able to connect more easily when I need it.)

@Arnaud30
Copy link

If you're not used to tinkering like this, you'll see, it's easy, exciting and it will take you to another level ;-)

@Osirismix
Copy link

Osirismix commented May 20, 2024

@Arnaud30 hey. Found the way to reset the password by IPWizardIII. So i figure it out and the camera goes to it's owner =D But i'm realy curious about tinkering and everything else so i think i'll do it with another camera, cause i have several of them with same defect, they just start restarting and it can go for hours? and i just want to know what's happening with them. and i hope you can help me with it. if there is some DM not to flood here we can go there thumb up

@sperglord8008s
Copy link

Neye3C camera: laohuqian
JVT camera: fxsdk+(camera password),fxjvt1805. Need open telnet port first(open telnet port firmware)
hankvision(blue GUI PTZ camera): HI2105CHIP
Xiongmai device:
root xmhdipc
root klv123
root xc3511
root 123456
root jvbzd
root hi3518
topsee(u-boot password): hdipc%No
RT-IPC: cat1029

@Dobie007
Copy link

Dobie007 commented Jun 23, 2024

I've got a Tuya TCP Smart cam here for which i would like to have the password:
shadow says:
root:$1$dVhFuDGx$YrOKRgTcjTCqEK75.z277/:15874:0:99999:7:::
It shows "Lobster" and
Linux version 3.10.27 (canjian@ubuntu) (gcc version 4.8.5 20150209 (prerelease) (Realtek RSDK-4.8.5p1 Build 2521) ) #1 PREEMPT Fri Dec 7 15:51:19 CST 2018

@EEtinkerer
Copy link

EEtinkerer commented Jun 25, 2024

somebody knows ?user:$1$ri3K4P4s$ne/es0YuNHyn0rti8KJ2a.:19404:0:99999:7:::

user:user123456

@xeroski
Copy link

xeroski commented Jun 28, 2024

Hi. Need help with smart cam:
root:$1$1m7mklzD$Hu1Z3GPZPUhpuiOBql3v7/:0:0:root:/:/bin/sh

@RenaKunisaki
Copy link

How are you recovering u-boot passwords? I have the ROM dump but don't know what to look for. I assume it's a hash stored somewhere?

@themactep
Copy link

@RenaKunisaki, it depends on the u-boot. older uboot can have in plain text as it is just a sequence of keys. newer one will have it hashed and scattered. Often times, you can skip the password altogether shorting pins on the flash chip during boot.

@Dobie007
Copy link

Dobie007 commented Jul 2, 2024

Here is a video series showing what to do to get the hash out - but it didn't help me further than what you can read above.
https://www.youtube.com/watch?v=LgurdIN1KW0
Editing the inittab file worked, but then i still haven't figured out what to do to get rid of the cloud..
It's as if i've got the hood of my car open but have no clue what all the stuff in there is..

@themactep
Copy link

themactep commented Jul 2, 2024

What camera is that? What SoC? We develop thingino - an open firmware for Ingenic cameras.

@Dobie007
Copy link

Dobie007 commented Jul 2, 2024

The one i have:
DRAM:Board: IPCAM RTS3903 CPU: 500M :rx5281 prid=0xdc02 64 MiB @ 1066 MHz
SF: Detected GD25Q128C with page size 256 Bytes, erase size 64 KiB, total 16 MiB

@themactep
Copy link

@Dobie007 I think we are hijacking the comments here. Come to our server, we'll talk about the camera there. https://discord.com/invite/snQwdVhh

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment