Package: hiktools
HiktoolsThis respository was former known ashikvision-sdk-cam, but has changed since the old content of this repository was deleted. This is now a small project with four main functionalities:A Wireshark dissector for the Search Active Devices Protocol,Decrypt and extract hikvision firmware,Send raw SADP packets (only Linux) andSend commands via UDP Broadcast.To get familiar with the API provided in this repository, take a quick look at the python documentation availablehere »or the
C++ documentation available at Github-Pageshere ».InstallationYou can now install thehiktoolsmodule with pip:$python3-mpipinstallhiktoolsOverviewUpdate:Since feature version1.1.0the native packet creation and communication works! It is still only usable on UNIX systems that support sending raw ethernet frames. The checksum algorithm was disassebled and decompiled correctly, just the input parameters were interpreted wrong. The algorithm is implemented inC/C++andpython3.Communication on UDP works fine at the moment - this API is just a small wrapper which can be used for a more general API.Firmware decryption and extraction will only work on newerdigicap.davfiles with at least1file entry (otherwise there will be no files to inspect) in the header. All firmware files and updates can be downloaded from the following endpoint (EU):https://www.hikvisioneurope.com/uk/portalThere is also a full list of files available at this enpoint stored in a JSON file namedfirmwarelist.json.Info: There is an interesting file located in the extracted files of a firmware image: /hroot.img/initrd/etc/passwd. A password is set to the root user:Name: passwd
Folder: -
Size: 44
Packed Size: 1 024
Mode: -rwxrwxr-x
Last change: 2016-12-23 08:27:46
Last modification: 2016-12-23 08:27:46
-------------------------------------------

root:ToCOv8qxP13qs:0:0:root:/root/:/bin/pshThe plain password ishiklinux, kudos toDon Bowman.Old exploit with authkey := YWRtaW46MTEKBasic UsageFirmware inspection and extractionfromhiktoolsimportfmod# Open the resource at the specified path (loading is done automatically)# or manually decrypt the firmware file (see documentation for actual code).withfmod.DigiCap('filename.dav')asdcap:# Iterate over all files stored in the DigiCap objectforfile_infoindcap:print('> File name="%s", size=%d, pos=%d, checksum=%d'%file_info)# get file amount and current languageprint("Files:%d, Language:%d"%(dcap.head.files,dcap.head.language))# save all files stored in <filename.dav>fmod.export(dcap,"outdir/")Or you can use the module main script to extract the files via the CLI:python3 -m hiktools.fmod input.dav outputDirNative interface on sending raw packets (only LINUX)fromhiktoolsimportcsadp# Because the following module requires root priviledges it# has to be imported directly.fromhiktools.csadpimportCServicesock=CService.l2socket('wlan0')counter=0x115e# To build an Inquiry packet, we need the following information:# - our mac, ipv4 and ipv6 address (and the counter of course)packet=csadp.inquiry('<MAC>','<IPv4>','<IPv6>',counter)# before we can send the message, a checksum has to be calculatedpacket.insert_checksum()sock.send(bytes(packet))response=csadp.SADPPacket(sock.recv(1024))# to view the contents just print the str() versionprint(str(response))Interact with the device through UDP broadcastfromhiktoolsimportsadpfromuuidimportuuid4# create a packet from a simple dict objectinquiry=sadp.fromdict({'Uuid':str(uuid4()).upper(),'MAC':'ff-ff-ff-ff-ff-ff','Types':'inquiry'})# Open up a client to communicate over broadcastwithsadp.SADPClient()asclient:# send the inquiry packetclient.write(inquiry)# iterate over all received packets (None is returned on error)forresponseinclient:ifresponseisNone:break# initiate the responsemessage=sadp.unmarshal(response.toxml())# message objects contain a dict-like implementationforproperty_nameinmessage:print(message[property_name])# e.g.print('Device at',message['IPv4Address'])