HankVision Megapixel WIP6001

[papinkivi]

Hi,

Background

I bought unbranded NVR Kit with 9 bullet cameras from:
https://www.e-ville.com/fi/3045495-elek ... telma.html (It has 8 cameras, but otherwise it is same)
https://www.shopclues.com/hankvision-9- ... ision.html

System worked fine few months. Now the NVR hangs after few hours and its very hot. I can't get it working stable so searching ZoneMinder as a solver.

Investigations

After (three days) of investigating here are my results.

NVR

Has DHCP on LAN1 (internet), 192.168.1.9 on LAN2 and WLAN has DHCP 192.12.12.120 - 220.

Camera

### Camera label

The only label in camera says:
Wireless Wi-Fi IP Camera
Model No: WIP6001-1.3MP
Power: DC 12V
TV System: PAL 3.6mm

### Camera addresses

Camera LAN DHCP is disabled by default. LAN addresses are about 192.168.1.61 - 69. WLAN addresses are about 192.20.20.120 - 140.

### Camera ports

NMAP result is following:
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
90/tcp open dnsix
8088/tcp open radan-http
10081/tcp open famdc
20203/tcp open unknown

#### Telnet

This site helped much: https://sergei.nz/ildvr-inc-mh40d06/ And the link http://sergei.nz/ildvr-inc-mh40d06-or- ... se-camera/ says that Telnet username and password should be HANKVISION, but I had no success.

#### Web UI

Web UI respods at port 80. Username and password there are admin. It advertises itself a Megapixel IP Camera. Response server header is Hankvision-Webs. If you browse using Internet Explorer, install required AxtiveX component, you are able to view streams. Wireshark says that streams (main and sub) are requested from port 90. JPEG stills are viewable (from port 80) via Chrome without extensions. In the UI I can see following details:

##### System - Basic information

Version: V1.04.10-170307
Product info: IPC-E15000-W0 series

##### Network - PORT

RTSP Port: 554
Onvif Port: 8999
Http Port: 80
Video Port: 90
Record Port: 8080

##### Network - Wifi (which I disabled)

SSID: HD-NVR-2AFD5096
Key: 12345678

Successful results

MJPEG

Web UI has following settings for MJPEG:
Resolution: 1280x720 (default) | Closed
Frame rate: 1 | 2 | 3 (default) | 4 | 5
Image quality: Lowest | Low | Average (default) | High | Highest

### ZoneMinder settings for MJPEG

Source Type: Remote
Protocol: HTTP
Method: Simple
Host Name: admin:admin@192.168.1.6x
Port: 80
Path: /jpgimage/1/image.jpg
(Also paths /jpgmulreq/1/image.jpg?key=0&lq=11 in browser, but not in ZoneMinder.)
Capture Width (pixels): 1280
Capture Height (pixels): 720
Default for others.

Failed results

Didn't got ONVIF, RTSP or port 90 working for main or sub stream. The exact paths are unknown. I'll continue on these if I got new ideas.

I'm not sure what are the differences in brands HankVision and HkVision, because UI uses HkVision JS and DLL drivers. Also HikVision, Megapixel (UI title) and Z-Ben (https://ipcamtalk.com/threads/reviving- ... 001.39147/ see same model) may have something common.

[CountyLine]

Try

Code: Select all

rtsp://admin:admin@<ip address>//Streaming/Channels/1

as the RTSP path.

It's from my only HikVision camera. It's default login/password combo is admin/12345. You could substitute that in the code above, although it would be a bit strange if they used a different login than that of port 80.

[snake]

Hankvision looks to be a blatant ripoff of the successful Hikvision. I don't know why anyone would purchase a camera like this. Hikvision is ok, but Hankvision...

A quick web search brings up these results on Hankvision:
https://ipcamtalk.com/threads/hankvisio ... ams.23961/
https://ipcamtalk.com/threads/beware-un ... ide.28143/
https://sergei.nz/ildvr-inc-mh40d06-sec ... re-part-2/

The images in the second link don't look like HIkvision's GUI at all.

Everything to be said about these has already been done in the above links.

[papinkivi]

Try

Code: Select all

rtsp://admin:admin@<ip address>//Streaming/Channels/1

as the RTSP path.

It's from my only HikVision camera. It's default login/password combo is admin/12345. You could substitute that in the code above, although it would be a bit strange if they used a different login than that of port 80.

Thanks for reply! The URL doesn't work. And doesn't either login/password combo. I just realized that RTSP port 554 isn't open (according to NMAP), so I tried port 90, with no success on FFMPEG or Remote RTSP.

Can test different URLs on VLC (VideoLAN) on Windows for faster results? When I try it I get different error response on port 554 (Can't connect) and 90 (Can't open stream)

[papinkivi]

Hankvision looks to be a blatant ripoff of the successful Hikvision. I don't know why anyone would purchase a camera like this. Hikvision is ok, but Hankvision...

A quick web search brings up these results on Hankvision:
https://ipcamtalk.com/threads/hankvisio ... ams.23961/
https://ipcamtalk.com/threads/beware-un ... ide.28143/
https://sergei.nz/ildvr-inc-mh40d06-sec ... re-part-2/

The images in the second link don't look like HIkvision's GUI at all.

Everything to be said about these has already been done in the above links.

Thanks for your opinions! I see HankVision seems to be blatant ripoff. I bought it only based on price (9 cameras and NVR at price of 400 €) the brand was unknown before (and after) purchase. I'm sorry about that (never buy clones again). But now I wan't some returns for my investment.

The GUI in second link matches my GUI.

[snake]

Did you try the two video paths from the end of the 2nd post in the first link?

You can try VLC gui or ffmpeg from command line first to get resolution, and verify the stream works. Can also try port 8080, as the post mentions. You might need to poke around the GUI to change settings, if the ports aren't open in nmap. When you get it working, then use source FFMPEG or libVLC in ZM. Testing the streams with ffmpeg would be something like:

Code: Select all

$ ffmpeg -i rtsp://user:password@<ipaddress>:554/mpeg4/ch01/main/av_stream > export.mp4

Code: Select all

$ ffmpeg -i rtsp://user:password@<ipaddress>:554/1/h264major > export.mp4

I would also try the Hankvision_2016 user/pass from the second link in telnet. If you can get shell access... See https://wiki.zoneminder.com/Finding_Camera_Stream_Paths for more reverse engineering docs.

[papinkivi]

Status report

I've crawled all given links and tested all given urls and telnet user:pass combinations. I tried to brute-force telnet using Hydra with over hundred known ipcam telnet combos.

New findings

If I try to change video port from 90, the old and new port isn't open according to nmap, but GUI works in IE.

The RTSP port will not open on 554. If I try to NMAP RTSP URL Brute on port 90 it does find nothing.

One weird response is from "http://<ip>:10081/OwnUserInfo.txt" -> "admin : admin : 6"

Actually in GUI only user admin is needed, pass can be anything!

Reset

Finally I have the courage to reset via GUI selecting to keep IP. Following changes noticed:
- Cam label in picture changed to "HD-IPC"
- Primary DNS 192.168.1.1
- Secondary DNS 8.8.8.8
- Wifi APSSID: IPC-002A2BFD0C08
- Wifi Channel: 13
- NTP server: 192.168.1.100

My local network is 10.x.x.x, so these aren't set by me or my DHCP.

I brute-forced those user:pass combos again after reset.

Next I have to try reset also IP. Hopefully I doesn't lost the cam

[papinkivi]

After full reset the IP is 192.168.1.18

[NiklasJ]

Hi. In the alarm server settings can you enter the ip address and if they are the electronics or if the alarm should be transported through the network.
What do they mean by alarm server here? Syslog or something else?
Which port?
What does such an alarm message look like?

Has anyone tested this?

// Niklas

[neles]

I tried to contact OP through DM, with no luck yet, so I will try to seek update through the thread. OP has linked my post before, as I also have two of the same cameras with exactly the same issues - virtualy identical, except for the branding - mine are Z-Ben WIP6001. Same interface too, and inabily to access the feeds, except using the Acrivex plugin in IE. I went through the same process as OP did, scanning ports, trying to get any way to access the feed, but no cigar.

Just wondering if anyone had any luck getting these to work in any capacity AT ALL. Just looking for any update before i chuck them in the garbage.

Thanks and kind regards.

[danielpetrica]

For anyone having this criminal bad camera like me I got telnet accesss to my camera using this github rep.

https://github.com/OH1KK/Aokwevision-AK-HD54F25

Basically account and password are: root:hkipc2016

Unfortunately my board is different from the one on the repo and I couldn't get the streams of the videos

[camando]

So i have a similar camera, have been through similar to the above, with the same findings , i.e the below ports open:

PORT STATE SERVICE
23/tcp open telnet
90/tcp open dnsix
8088/tcp open radan-http
10081/tcp open famdc
20203/tcp open unknown

can also telnet into it using the password from danielpetrica's post, and access the obscure httpd page on 10081 containing the "OwnUserInfo.txt" i

the only way i seem to be able to get a video feed from the camera is by scanning the QRcode and using the "Hisee SE" android app... however, im trying to get a feed so as i can record to my sinology "surveillance station" software,

i just cant seem to get any streams from it using any of the stream paths i can find on the web

however..

interestingly if i run the "HCMS_2.3.3" camera software i downloaded, the software instantly finds the camera on the LAN and im able to view and control the PTZ using it.. using TCPView i can see a connection from the software to the camera over Port 90... im just unable to workout HOW this software is getting a feed ?

does anyone know how this is working?

[pbissoondial]

Hello,
Has anyone been able to get the link to the video feed?

Tried with BlueIris software demo version but without any success.

A+
PB