Skip to content

Instantly share code, notes, and snippets.

@gabonator
Last active November 14, 2024 18:18
Show Gist options
  • Save gabonator/74cdd6ab4f733ff047356198c781f27d to your computer and use it in GitHub Desktop.
Save gabonator/74cdd6ab4f733ff047356198c781f27d to your computer and use it in GitHub Desktop.
HiSilicon IP camera root passwords
Summary of passwords by sperglord8008s, updated November 1. 2020. For login try "root", "default", "defaul" or "root"
00000000
059AnkJ
4uvdzKqBkj.jg
7ujMko0admin
7ujMko0vizxv
123
1111
1234
1234qwer
2601hx
12345
54321
123456
666666
888888
1111111
/*6.=_ja
anko
anni2013
annie2012
avtech97
cat1029
ccadmin
cxlinux
default
dreambox
fxjvt1805
hdipc%No
hi3518
hichiphx
hipc3518
hkipc2016
hslwificam
ikwb
ipc71a
IPCam@sw
ivdev
juantech
jvbzd
jvtsmart123
klv123
klv1234
meinsm
OxhlwSG8
pass
password
realtek
root
hi3518
S2fGqNFs
service
smcadmin
supervisor
support
system
tech
tlJwpbo6
ubnt
user
vhd1206
vizxv
xc3511
xmhdipc
zlxx.
Zte521
@themactep
Copy link

@RenaKunisaki, it depends on the u-boot. older uboot can have in plain text as it is just a sequence of keys. newer one will have it hashed and scattered. Often times, you can skip the password altogether shorting pins on the flash chip during boot.

@Dobie007
Copy link

Dobie007 commented Jul 2, 2024

Here is a video series showing what to do to get the hash out - but it didn't help me further than what you can read above.
https://www.youtube.com/watch?v=LgurdIN1KW0
Editing the inittab file worked, but then i still haven't figured out what to do to get rid of the cloud..
It's as if i've got the hood of my car open but have no clue what all the stuff in there is..

@themactep
Copy link

themactep commented Jul 2, 2024

What camera is that? What SoC? We develop thingino - an open firmware for Ingenic cameras.

@Dobie007
Copy link

Dobie007 commented Jul 2, 2024

The one i have:
DRAM:Board: IPCAM RTS3903 CPU: 500M :rx5281 prid=0xdc02 64 MiB @ 1066 MHz
SF: Detected GD25Q128C with page size 256 Bytes, erase size 64 KiB, total 16 MiB

@themactep
Copy link

@Dobie007 I think we are hijacking the comments here. Come to our server, we'll talk about the camera there. https://discord.com/invite/snQwdVhh

@abdberkana
Copy link

can somebody help me with this password retrieved from camera : root:XT5eZpUYaEB4c:0:0::/root:/bin/sh

@L4ky
Copy link

L4ky commented Aug 6, 2024

I have this user but I don't know the password. Could you help me?

root:8dxMkZjXi01sk:0:0::/root:/bin/sh

ipc@hs66

A guy cracked it yesterday in 16 minutes using hashcat on 14 x RTX 4090 ( Yes, you read it right ).

@gfarcas
Copy link

gfarcas commented Aug 13, 2024

I'm trying to repurpose a PNI camera that seems to be using the Hope chips. I have dumped the eeprom and found references to hi3518 drivers and the following user hash
root:$1$b/rCFZCG$fSXVN88aYy/g3LUhsGNU01
I've also found a _passwd file that had root:ab8nBoH3mb8.g, for which the password was already posted here helpme (I suppose it's for uboot?)

Can someone help me with the hash above?

I have other routes to try yet, after I put the eeprom back on the board I want to check also the serial console, my aim is to redirect/start a rtsp stream to use the camera with frigate.

@Dobie007
Copy link

Dobie007 commented Oct 6, 2024

Hi, can someone help on this one from an image of a SOOCOO S300 Action cam that is not supported anymore:
root:$1$$qRPK7m23GJusamGpoGLby/:0:0::/root:/bin/sh

@Arnaud30
Copy link

Arnaud30 commented Oct 6, 2024

il s'agit de la chaîne MD5crypt pour un mot de passe vide avec un sel vide :

crypt.crypt('', '$1$$')
'$1$$qRPK7m23GJusamGpoGLby/'

@Dobie007
Copy link

Dobie007 commented Oct 6, 2024

Thanks! - I didn't realize!

@imgege
Copy link

imgege commented Oct 10, 2024

Hi all, please help me to decrypt the password of telnet bvt user

bvt:$1$6LM5P7B4$z6ZaflT5B2h6spyn02CZw0:0:0:bvt:/home:/bin/sh

@smsilv
Copy link

smsilv commented Oct 23, 2024

Tuya/Aldi cam, would like to have the password.
AK3918EN080 V300S (Anyka).
cat shadow:
root:$1$1m7mklzD$Hu1Z3GPZPUhpuiOBql3v7/:0:0:root:/:/bin/sh

Thanks in advance.

@foxyc
Copy link

foxyc commented Oct 29, 2024

Hi all. Can you help me to determine what type of crypto algorithm give hash like this: oEP0ZGfC
and this:
root:8/3DL08/eA4ic:0:0:root:/:/bin/sh

Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment