decode password

[eduaqa]

It is possible to decode the password the NVR is sending to the camera?
I capture the tcpdump and a I have

From the camera to NVR Realm: Login to <the name of the camera> Random: 1792458991
and the response from NVR I have admin&& 4A5012CC01A2BCCA643BA09C342BE4F5A863141FF96A2FD758412AC1F5E6D1B2

so it's possible to decode the response?

[Revo2Maxx]

So are you still trying to find out your NVR's password? Last month you had mentioned that you were without a Reset and what not but never replied to any info that was given.

Or are you asking if your system could be hacked by the outside with your info if someone happen to be trying to get data from your connection off Wireshark?

In an answer Maybe. I don't want to say no and I don't want to say yes because the cipher used isn't standard and the person that is trying to hack you would have to have made a system that would be able to translate that info..

[eduaqa]

Yes, still trying to find the NVR password. I was not able to remove it. So, next trying is:
It has some camera configured on it. I put one of my cameras on that IPs and got "invalid password" on the NVR when trying to connect to the camera, of course it's trying to connect to my camera with the password that is set on the NVR (that not means to be the same), but maybe if I knew the password that it's trying to connect to the camera, maybe can be the same for the NVR.
So I used the Wireshark to capture the traffic between the NVR and the camera and got that information. So if I can decode the password been passed to the camera from NVR when trying to connect to the camera, maybe the admin for the NVR can be the same.

[Revo2Maxx]

Well something to try change pass to admin and try again and it will connect. By default poe password unless that camera and nvr was already paired and changed before.

Any reset email or pattern present? Either way only brute force or last owner help will unlock it

[jack7NewUsername]

This may be a way to get a new password without having an email address in NVR.

https://amcrest.com/password

[Revo2Maxx]

The NVR is to modern and has already tried talking with Support over it if you look in the first post from last month. As I stated there and again here Brute Force is only way. IN truth the cost of a Pen Tester would out cost a new machine so they will want to try and do all the steps I have tried to outline to get that done.

Password reset from Older Machine will not work on a 41xx-hs or any of the newer model Recorders or cameras.

[Revo2Maxx]

@eduaqa What method did you try to connect your NVR with your camera? Seeing your first post states that your machine is a non POE version. I just tried on my 4216E-AI and the ports don't talk to one another so that is good to hear that has been closed.

On my 4116E-HS it isn't the same story and I was able to talk to my NVR and cameras over my computer connected to my POE ports however all data that I got was much different them the one you stated above. So I am trying to find where your connection between your camera and NVR. If your NVR is a POE and all ports have not been changed to a new password then as I said before a camera with Reset stats (meaning admin and admin) would work to connect your camera to the NVR..

However in your first post you listed it as a 4108-HS and that I am having a hard time understanding how you tried to connect a camera to an NVR if you don't know how to connect to the NVR. If you have connected to the NVR over Pattern I have a way that you can recover the NVR and make a password known but without knowing if you made it in to the menus not going to post on blast as I have already done that even made videos of how.

Can't help if we don't get enough information on the status

[Revo2Maxx]

OK sorry I read again your above post from your connection method. Sorry I have loads of things going on and after read first time, I had to do somethings and when I returned didn't retain the whole post (Didn't read again either until now sorry)

So ok on your NVR looking at the GUI you see that there is camera or multi cameras in Display with IP, You setup your network or testing portion of the network to try and make a Camera with same IP as the connected camera and took the info from that..

So no start of access yet? Never did get an answer if your machine has a Pattern or if it is only access by pass code?
Also if you click forgot pattern if it has one, and forgot password is there a email listed? if there is one is it PVT server like yourdomain dot com or a normal email server like gmail, hotmail, yahoo etc...?

This info is important to help find out next steps to take.

[Revo2Maxx]

Anything new since your last post? Ever get it Unlocked? What type of things have you tried besides looking at the data in the first part of your post here?

[Revo2Maxx]

Kind of hard to work on something that isn't in front of you so I don't know and I am going to close this with this. On my 4108E-HS and my 4116E-HS systems I have reset buttons. I asked my son to go look at my 4108-HS and sure enough it don't have one he says. I asked him to take a picture of the board an his camera is broke on his phone from when he dropped the phone so wasn't able to . Asked him to tell me what he see. In about the center of the board going toward the front there is a K1 that don't have a button there and 4 pads. Because I wasn't able to see the board and it is 2500 miles away I told him what was on mine even though both my 4108E-HS and 4116E-HS both don't work the button is there.. So after about an hour of him trying to tell me what he is looking at I took a picture of my 4116E-HS reset button area and sent it to him making sure only to keep in focus the Reset area. After seeing the picture first thing he says is right next to the button is a missing part board showing 2 solder parts.

So with that I conclude that the 4108-HS that your working with most likely isn't only missing a button but it most likely missing a Very small SMD Capacitor don't know the Value however it is very very small like a 0201 or a 0402 I mean it is small... SO I took off my switch seeing it don't work anyway and took a photo so you know what your dealing with. When I sent my son the photo he said that was for sure not on the board either so just doing a jumper from pad 1 to pad 2 or even installing a push button there will not make it work without the small SMD Cap there as well.. You can see in the picture Cap is smaller then the buttons solder pad lol so it is VERY SMall.. The image was to large for the forum so I took a screenshot and reduced the image. C39 on this board is the one i am talking about, don't know what the C number was as I didn't ask him. He already isn't happy about having to travel over an hour away from his place to look at these things lol. Glad he is willing to help..

Screenshot (1939).png (814.72 KiB) Viewed 2477 times