Dahua SmartPSS V2.X device account recovery

iTuneDVR

iTuneDVR

Pulling my weight
Aug 23, 2014
885
163
Россия
[+] Decrypt Dahua SmartPSS V2.X device hash username & password from OrganizationDevice.xml
[+] Decrypt Dahua SmartPSS V2.X device hash passwords from export Device.xml
 
Last edited:
  • Like
Reactions: shelestoff
Hello,

I need help to decrypt the password for one NVR in Smart PSS V2 (old version).

Device name: Taller

Encoded username: yjEMA0HUurUHH0bSSuBr3A==
Encoded password: fRPJUOcDAdHxQl615K7r1A==

Could someone please run these through the decryption tool/bot?

Thank you very much!
 
Sohaun said:
Encoded username: yjEMA0HUurUHH0bSSuBr3A==
Encoded password: fRPJUOcDAdHxQl615K7r1A==
Click to expand...
For bot need hash from export.xml, from loaded SmartPSS. All you show data from file OrganizationDevice.xml.
Show all file as is or make export and put hash to bot
 
Hello,

Thank you for the clarification. This is the exported device list from loaded SmartPSS (Devices > Export XML or similar).

Full device.xml content:

<?xml version="1.0" encoding="UTF-8"?>
<DeviceManager version="2.0">
<Device name="Almacén Nuevo" domain="192.168.250.26" port="37777" username="IT" password="SeUmK2U2j5IshOGhaKby5KT1P8/yXwE4u3ak5ZfBzmmUScFXSSY5AwE/8+JU" protocol="1" connect="0" />
<Device name="Curados1" domain="192.168.250.27" port="41176" username="IT" password="5EHkQoPg7XOS+nhyzNtee8B8Lik5d/kdcwD8vyoeXY8KZvgOvHtr49SxnJif" protocol="1" connect="0" />
<Device name="Curados2" domain="192.168.250.28" port="37777" username="IT" password="pFXWIJbvqVd/gRoMnYdeKHG6bLkwQRInT/8i9w6+M6Yx07vt2CdPRNnMtDgu" protocol="1" connect="0" />
<Device name="Entrada Hi...(truncated 1008 characters)...O/ebiBoWcqnEiGXWCArSxsc90dx7Ze/SPzCJ" protocol="1" connect="0" />
<Device name="Grabador Nuevo 2" domain="192.168.250.101" port="37777" username="IT" password="tIq84OUM3bwRPH2inggctKXIRwoVq50eed8FbyrpVy35ksJcZtiLxAFCmVIh" protocol="1" connect="0" />
<Device name="Grabador Nuevo 3" domain="192.168.250.102" port="37777" username="IT" password="gmHGFl+GdhF2FxUEYvNmy0LFDzAmT3EZYHypCkMLpF43mHjqmKWRlJjUfJ2B" protocol="1" connect="0" />
<Device name="Taller" domain="192.168.250.105" port="37777" username="Argal" password="RLmIoIfLBOMSwPXlP+RD1CgbAQIJ6+QeaeQm2hBt0959JUcOQZILm9cb" protocol="1" connect="0" />
</DeviceManager>

Please run this through the bot/decryption tool. Especially interested in the "Taller" device (username "Argal").

Thank you very much!
 

Attachments

All hash from device.xml decrypted.
Very strange, that all password are the same, except last one "Taller"

And this
Sohaun said:
Encoded username: yjEMA0HUurUHH0bSSuBr3A==
Encoded password: fRPJUOcDAdHxQl615K7r1A==
Click to expand...
not corresponding to "Taller" data.
Very strange. Not clear.
 
Last edited:
iTuneDVR said:
All hash from device.xml decrypted.
Very strange, that all password are the same, except last one "Taller"

And this

not corresponding to "Taller" data.
Very strange. Not clear.
Click to expand...
Thank you for checking!

Yes, all the "IT" devices share the same password (that's normal in our setup).

The one I urgently need is only for "Taller":
  • Name: Taller
  • Username: Argal
  • Encrypted password: RLmIoIfLBOMSwPXlP+RD1CgbAQIJ6+QeaeQm2hBt0959JUcOQZILm9cb

Could you please share the decrypted plain text password for this one?

Thanks a lot in advance!
 
Sohaun said:
Encoded username: yjEMA0HUurUHH0bSSuBr3A==
Encoded password: fRPJUOcDAdHxQl615K7r1A==
Click to expand...
This not corresponding to Tailer!
Put here your Organization.xml as is.
Not see any your request at bot.
It's seem to me it's not your data.
 
iTuneDVR said:
This not corresponding to Tailer!
Put here your Organization.xml as is.
Not see any your request at bot.
It's seem to me it's not your data.
Click to expand...
Sorry for the

I sent two different files by mistake.

Here is the full original OrganizationDevice.xml from my SmartPSS folder (C:\Users\Public\SmartPSS), exactly “as is” as you requested:
 

Attachments

Thank you again for your help!


I’m really sorry for the confusion with the two files. The second XML I just sent is the real and current OrganizationDevice.xml from my SmartPSS installation.


This DVR “Taller” is mine (it’s an old Dahua system from around 2018). I have many other cameras connected to the same Smart PSS (you can see them in the file: Almacén Nuevo, Curados1, Parking, etc.). Everything was working fine until someone changed the password on “Taller” and now I can’t access it.


If I can’t recover this password, I will have to replace the entire old NVR and all the configuration, which means a very big and expensive investment (new hardware + reinstalling everything). That’s why I really need only the password for “Taller” (username “Argal”).


Could you please run the bot one more time with this correct file and share the plain text password for “Taller”?


Thank you very much, I really appreciate your help!
 
You data from Organization.xml from what SmartPSS version if it real work?
Show screenshot from work version SmartPSS.
Your data strange.
Long hash is normal but short it not. It's very strange and seems like compilation data with strange legend.
Bot work normal, but i don't see any your request.
Maybe exist other bot or tool i don't know.
 
Sohaun said:
Hello,

Thank you for the clarification. This is the exported device list from loaded SmartPSS (Devices > Export XML or similar).

Full device.xml content:

<?xml version="1.0" encoding="UTF-8"?>
<DeviceManager version="2.0">
<Device name="Almacén Nuevo" domain="192.168.250.26" port="37777" username="IT" password="SeUmK2U2j5IshOGhaKby5KT1P8/yXwE4u3ak5ZfBzmmUScFXSSY5AwE/8+JU" protocol="1" connect="0" />
<Device name="Curados1" domain="192.168.250.27" port="41176" username="IT" password="5EHkQoPg7XOS+nhyzNtee8B8Lik5d/kdcwD8vyoeXY8KZvgOvHtr49SxnJif" protocol="1" connect="0" />
<Device name="Curados2" domain="192.168.250.28" port="37777" username="IT" password="pFXWIJbvqVd/gRoMnYdeKHG6bLkwQRInT/8i9w6+M6Yx07vt2CdPRNnMtDgu" protocol="1" connect="0" />
<Device name="Entrada Hi...(truncated 1008 characters)...O/ebiBoWcqnEiGXWCArSxsc90dx7Ze/SPzCJ" protocol="1" connect="0" />
<Device name="Grabador Nuevo 2" domain="192.168.250.101" port="37777" username="IT" password="tIq84OUM3bwRPH2inggctKXIRwoVq50eed8FbyrpVy35ksJcZtiLxAFCmVIh" protocol="1" connect="0" />
<Device name="Grabador Nuevo 3" domain="192.168.250.102" port="37777" username="IT" password="gmHGFl+GdhF2FxUEYvNmy0LFDzAmT3EZYHypCkMLpF43mHjqmKWRlJjUfJ2B" protocol="1" connect="0" />
<Device name="Taller" domain="192.168.250.105" port="37777" username="Argal" password="RLmIoIfLBOMSwPXlP+RD1CgbAQIJ6+QeaeQm2hBt0959JUcOQZILm9cb" protocol="1" connect="0" />
</DeviceManager>

Please run this through the bot/decryption tool. Especially interested in the "Taller" device (username "Argal").

Thank you very much!
Click to expand...
Almacén Nuevo
192.168.250.26:37777
IT:ITadmin1

Curados1
192.168.250.27:41176
IT:ITadmin1

Curados2
192.168.250.28:37777
IT:ITadmin1

Entrada Higiénica
192.168.250.29:37777
IT:ITadmin1

Parking
192.168.250.30:37777
IT:ITadmin1

Pasillo Vestuario
192.168.250.31:37777
IT:ITadmin1

Porteria
192.168.250.32:41176
IT:ITadmin1

Altillo Pasarela Porteria
192.168.250.33:37777
IT:ITadmin1

Grabador Nuevo 1
192.168.250.100:37777
IT:ITadmin1

Grabador Nuevo 2
192.168.250.101:37777
IT:ITadmin1

Grabador Nuevo 3
192.168.250.102:37777
IT:ITadmin1

Taller
192.168.250.105:37777
Argal:Antonio15$
 
  • Like
Reactions: iTuneDVR
You must log in or register to reply here.
Top Bottom