A weak password identification method and related equipment

Abstract

The embodiment of the present application provides a weak password identification method, including: identifying the communication protocol of the network to which the target computer belongs; when the communication protocol is the SMB protocol, collecting the login password of the target computer through the flow collection technology; obtaining the Net‑NTLMHash information corresponding to the login password of the target computer; determining the password strength of the target computer through the built-in weak password set and the Net‑NTLMHash information corresponding to the login password of the target computer. In this way, by collecting the flow of computers in the domain server, obtaining the corresponding Net‑NTLM Hash information based on the collected login password information, and determining the password strength of the target computer according to the matching of the built-in weak password set and the Net‑NTLM Hash information corresponding to the login password of the target computer, the operation of data collection can be simplified, the verification of password strength can be realized in an offline state, the impact on the server during the weak password identification process can be reduced, and the identification efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a weak password identification method and related equipment. Background Art

[0002] Weak passwords are passwords that are easily cracked, and are usually simple combinations of numbers, the same combination of numbers as the account number, adjacent keys on the keyboard, or common names, etc. When weak passwords exist in the domain server, it means that the security of the domain server is reduced and the risk of information leakage is greatly increased.

[0003] The current weak password identification method requires exporting the SAM file from the domain server to generate a weak password hash library with the same domain control password algorithm. Password detection based on the weak password hash library requires administrator privileges. The detection process is complex, the operation is cumbersome, and the time cost is high. In addition, the weak password hash library is time-sensitive. After being used for a period of time, there may be a risk of low detection success rate, which will affect the security of the domain server. Summary of the invention

[0004] The present invention provides a weak password identification method to solve the problem that the current weak password identification method needs to obtain administrator privileges and export a SAM file from a domain server, resulting in a complex detection process, cumbersome operations, and high time cost. At the same time, due to the timeliness of the above-mentioned weak password hash library, there is a risk that the detection success rate will decrease over time, which will in turn affect the security of the domain server.

[0005] In a first aspect, the present invention provides a method for identifying a weak password, comprising:

[0006] Identify the communication protocol of the network to which the target computer belongs;

[0007] In the case where the communication protocol is the SMB protocol, collecting the login password of the target computer through traffic collection technology;

[0008] Obtain Net-NTLM Hash information corresponding to the login password of the target computer;

[0009] The password strength of the target computer is determined through the Net-NTLM Hash information corresponding to the built-in weak password set and the login password of the target computer.

[0010] Optionally, the method further includes:

[0011] Obtaining account information of the target computer;

[0012] Obtaining a server account robustness list of the network to which the target computer belongs;

[0013] In a case where the account information in the server account robustness list includes the account information of the target computer, obtaining the remaining validity time of the account information in the server account robustness list;

[0014] When the remaining valid time is greater than or equal to the preset time, the password strength corresponding to the account information is determined as the password strength of the target computer.

[0015] Optionally, the method further includes:

[0016] When the login password of the target computer is a weak password, a warning message is issued.

[0017] Optionally, the method further includes:

[0018] In a case where the account information in the server account robustness list does not include the account information of the target computer, determining the remaining validity time of the account information of the target computer based on the password strength of the target computer;

[0019] The target computer's account information, the target computer's password strength, and the remaining validity time of the target computer's account information are stored in the server account robustness list.

[0020] Optionally, the method further includes:

[0021] When the communication protocol is not the SMB protocol, a prompt message is issued.

[0022] Optionally, the obtaining Net-NTLM Hash information corresponding to the login password of the target computer includes:

[0023] Obtaining version information of the SMB protocol;

[0024] Based on the version information and the login password of the target computer, Net-NTLM Hash information of the login password of the target computer corresponding to the version information is acquired.

[0025] Optionally, determining the password strength of the target computer by using Net-NTLMHash information corresponding to a built-in weak password set and a login password of the target computer includes:

[0026] Save the Net-NTLM Hash information corresponding to the login password of the target computer;

[0027] Using hashcat to crack the Net-NTLM Hash information corresponding to the login password of the target computer based on the built-in weak password set;

[0028] In the case of successful cracking, it is determined that the login password of the target computer is a weak password.

[0029] In a second aspect, the present invention further provides a weak password identification device, comprising:

[0030] An identification module, used to identify the communication protocol of the network to which the target computer belongs;

[0031] A collection module, used for collecting the login password of the target computer through traffic collection technology when the communication protocol is the SMB protocol;

[0032] An acquisition module, used for acquiring Net-NTLM Hash information corresponding to the login password of the target computer;

[0033] The determination module is used to determine the password strength of the target computer through the Net-NTLM Hash information corresponding to the built-in weak password set and the login password of the target computer.

[0034] In a third aspect, the present invention further provides an electronic device, comprising a memory and a processor, wherein the processor is used to implement the steps of the weak password identification method as described in any one of the first aspects above when executing a computer program stored in the memory.

[0035] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the weak password identification method as described in any one of the first aspects are implemented.

[0036] It can be seen from the above technical scheme that the embodiment of the present application provides a weak password identification method, including: identifying the communication protocol of the network to which the target computer belongs; when the communication protocol is the SMB protocol, collecting the login password of the target computer through the flow collection technology; obtaining the Net-NTLM Hash information corresponding to the login password of the target computer; determining the password strength of the target computer through the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer. The current weak password identification method needs to export the SAM file from the domain server to generate a weak password hash library with the same domain control password algorithm. Password detection based on the above weak password hash library requires obtaining administrator privileges, and the detection process is complicated, the operation is cumbersome, and the time cost is high. In addition, the above weak password hash library has timeliness, and there may be a risk of low detection success rate after a period of use, which will affect the security of the domain server. The embodiment of the present application collects traffic from the computer in the domain server, obtains the corresponding Net-NTLM Hash information based on the collected login password information, and determines the password strength of the target computer according to the matching of the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer. In this way, the data collection operation can be simplified, and the password strength can be verified offline, reducing the impact on the server during the weak password identification process and improving the identification efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0038] Figure 1 A schematic flowchart of a weak password identification method provided in an embodiment of the present application;

[0039] Figure 2 A schematic structural diagram of a weak password identification device provided in an embodiment of the present application;

[0040] Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application;

[0041] Figure 4 A schematic structural diagram of a computer-readable storage medium provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The embodiments will be described in detail below, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation methods described in the following embodiments do not represent all implementation methods consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims. In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways, and the device embodiments described below are merely exemplary.

[0043] This application provides a method for identifying weak passwords, such as Figure 1 As shown, including:

[0044] Step S110: Identify the communication protocol of the network to which the target computer belongs.

[0045] Step S120: When the communication protocol is SMB protocol, the login password of the target computer is collected by using traffic collection technology.

[0046] Exemplarily, the above-mentioned traffic collection technology can be to capture data packets through a sniffer, so as to monitor the network status, data flow and information transmitted on the network.

[0047] Step S130: Obtain Net-NTLM Hash information corresponding to the login password of the target computer.

[0048] Step S140: Determine the password strength of the target computer through the built-in weak password set and the Net-NTLMHash information corresponding to the login password of the target computer.

[0049] Exemplarily, the above-mentioned built-in weak password set may be independently set by an administrator, or may be a weak password dictionary directly obtained from the Internet.

[0050] By collecting traffic from computers in the domain server, the corresponding Net-NTLM Hash information is obtained based on the collected login password information, and the strength of the target computer's password is determined based on the matching of the built-in weak password set and the Net-NTLM Hash information corresponding to the target computer's login password. This can simplify the data collection operation and verify the strength of the password in an offline state, which can reduce the impact on the server during the weak password identification process and improve the identification efficiency.

[0051] According to some embodiments, the method further comprises:

[0052] Obtain account information of the above target computer;

[0053] Get the server account robustness list of the network to which the above target computer belongs;

[0054] In a case where the account information in the server account robustness list includes the account information of the target computer, obtaining the remaining validity time of the account information in the server account robustness list;

[0055] When the remaining valid time is greater than or equal to the preset time, the password strength corresponding to the account information is determined to be the password strength of the target computer.

[0056] Exemplarily, the server account robustness list includes at least server IP information, operating system information, user name information, weak password information and remaining validity period. The target computer account information is account information determined based on the server IP information, operating system information and user name information. The preset time can be set independently by the administrator, can be determined based on the historical change cycle of the server account robustness list, or can be manually imported into the server's SAM file, detected based on the SAM file, and the detected results are summarized.

[0057] By matching the target computer's account information with the server account robustness list of the target computer's network, the target computer's login password's strength cycle can be obtained when the above information matches. When the current matching time is within the above strength cycle, the target computer's login password's strength can be directly determined, thereby simplifying the recognition operation and improving recognition efficiency.

[0058] According to some embodiments, the method further comprises:

[0059] When the login password of the target computer mentioned above is at risk of being weak, a warning message is issued.

[0060] Exemplarily, the warning message may include the weak password risk of the login password, the account information of the target computer, and the identification time of the weak password. The warning message may be sent through channels such as email, syslog, and WeChat. Within the preset period of sending the warning message, the access function of the target computer may be stopped, and the access function may be restored after the administrator completes the password upgrade.

[0061] When the login password of the target computer mentioned above has a weak password risk, issuing an alarm message can improve the management staff's supervision efficiency and reduce the security risk of domain server intrusion.

[0062] According to some embodiments, the method further comprises:

[0063] In the case that the account information in the server account robustness list does not include the account information of the target computer, determining the remaining validity time of the account information of the target computer based on the password strength of the target computer;

[0064] The account information of the target computer, the password strength of the target computer and the remaining validity time of the account information of the target computer are stored in the server account robustness list.

[0065] Exemplarily, a mapping table may be established based on the above password strength and the remaining validity time of the target computer's account information. When new account information appears, the remaining validity time of the new account's password strength may be directly obtained by looking up the table.

[0066] When the account information in the above-mentioned server account robustness list does not include the account information of the above-mentioned target computer, the remaining validity time of the strength of the current password of the target computer can be determined, and the server account robustness list can be updated based on the above-mentioned remaining validity time. The steps of the password recognition operation can be simplified within the cycle and the recognition efficiency can be improved.

[0067] According to some embodiments, the method further comprises:

[0068] If the communication protocol is not the SMB protocol, a prompt message is issued.

[0069] Exemplarily, the prompt information may include the communication protocol of the network to which the target computer belongs and the account information of the target computer. The prompt message may be sent through channels such as email, syslog and WeChat.

[0070] When the above communication protocol is not the SMB protocol, it means that the above weak password identification method is not applicable to the above target computer. Therefore, it is necessary to issue a prompt message in time to notify the administrator to identify the password strength through other methods as soon as possible, thereby improving the security of the domain server.

[0071] According to some embodiments, the obtaining of Net-NTLM Hash information corresponding to the login password of the target computer includes:

[0072] Get the version information of the above SMB protocol;

[0073] Based on the version information and the login password of the target computer, Net-NTLM Hash information of the login password of the target computer corresponding to the version information is obtained.

[0074] Exemplarily, according to the version information of the SMB protocol, the response protocol in the NTLM authentication process can be determined, and based on the response protocol, the target extraction field of the login password, the format of the Net-NTLM Hash information and the challenge format can be determined.

[0075] For example, in the case where the response protocol is the NTLMv2 protocol, a request is sent to the server of the network to which the target computer belongs through the target computer. After receiving the request, the server generates a 16-bit challenge, sends the challenge to the target computer, encrypts the challenge based on the login password of the target computer through the target computer, and sends the encrypted challenge as a response to the server for verification. The format of the Net-NTLM Hash is: username::domain:challenge:HMAC-MD5:blob, wherein the username is the user name of the target computer, the domain is the IP information of the target computer or the computer host name in the data packet, the challenge is the NTLM Server Challenge, the NTProofStr field in the HMAC-MD5 data packet, and the blob is the reply-NTProofStr.

[0076] Based on the version information of the SMB protocol, the Net-NTLMHash information of the login password of the target computer can be determined more accurately, which can reduce the steps of obtaining the Net-NTLM Hash information, avoid determining the above Net-NTLM Hash information through all versions corresponding to the SMB protocol, simplify the operation steps of password identification, reduce the complexity of identification information, and improve the efficiency of identifying the strength of passwords.

[0077] According to some embodiments, determining the password strength of the target computer through the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer includes:

[0078] Save the Net-NTLM Hash information corresponding to the login password of the above target computer;

[0079] Using hashcat to crack the Net-NTLM Hash information corresponding to the login password of the target computer based on the built-in weak password set;

[0080] In case of successful cracking, it is determined that the login password of the above target computer is a weak password.

[0081] Exemplarily, the response protocol in the NTLM authentication process can be determined based on the version information of the SMB protocol, and the hash type information -m specified by the hashcat can be determined based on the type of the response protocol. For example, when the response protocol is the NTLMv2 protocol, the value corresponding to the -m is 5600. The password cracking program can be run by the hashcat based on the information in the built-in weak password set, wherein the password cracking program can include a combination of the information in the built-in weak password set to crack the Net-NTLM Hash information corresponding to the login password of the target computer.

[0082] Exemplarily, the Net-NTLM Hash information corresponding to the built-in weak password set can also be obtained, and the Net-NTLM Hash information corresponding to the login password of the above-mentioned target computer and the Net-NTLM Hash information corresponding to the built-in weak password set can be matched. When the above-mentioned information matches successfully, it is determined that the login password of the above-mentioned target computer is a weak password.

[0083] By using hashcat to perform offline blasting on the Net-NTLM Hash information corresponding to the login password of the target computer, the strength of the password can be automatically and batch-wise identified, which improves the efficiency and practicality of password strength identification.

[0084] like Figure 2 As shown, Figure 2 A schematic structural diagram of a weak password identification device provided in an embodiment of the present application.

[0085] The embodiment of the present application provides a weak password identification device 200, which includes:

[0086] Identification module 201, used to identify the communication protocol of the network to which the target computer belongs;

[0087] The collection module 202 is used to collect the login password of the target computer through the flow collection technology when the communication protocol is the SMB protocol;

[0088] The acquisition module 203 is used to acquire the Net-NTLM Hash information corresponding to the login password of the target computer;

[0089] The determination module 204 is used to determine the password strength of the target computer through the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer.

[0090] A weak password identification device 200 can realize Figure 1 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0091] like Figure 3 As shown, Figure 3 A schematic structural diagram of an electronic device provided in an embodiment of the present application.

[0092] The embodiment of the present application provides an electronic device 300, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the computer program 311, the following steps are implemented:

[0093] Identify the communication protocol of the network to which the target computer belongs;

[0094] In the case where the above communication protocol is the SMB protocol, the login password of the above target computer is collected through traffic collection technology;

[0095] Get the Net-NTLM Hash information corresponding to the login password of the above target computer;

[0096] The password strength of the target computer is determined through the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer.

[0097] In the specific implementation process, when the processor 320 executes the computer program 311, it can achieve Figure 1 Any implementation manner in the corresponding embodiments.

[0098] Since the electronic device introduced in this embodiment is a device used to implement a device in the embodiment of the present application, based on the method introduced in the embodiment of the present application, technical personnel in this field can understand the specific implementation method of the electronic device of this embodiment and its various variations. Therefore, how the electronic device implements the method in the embodiment of the present application is not introduced in detail here. As long as the equipment used by technical personnel in this field to implement the method in the embodiment of the present application is within the scope of protection of this application.

[0099] like Figure 4 As shown, Figure 4 A schematic structural diagram of a computer-readable storage medium provided in an embodiment of the present application.

[0100] This embodiment provides a computer-readable storage medium 400, on which a computer program 411 is stored. When the computer program 411 is executed by a processor, the following steps are implemented:

[0101] Identify the communication protocol of the network to which the target computer belongs;

[0102] In the case where the above communication protocol is the SMB protocol, the login password of the above target computer is collected through traffic collection technology;

[0103] Get the Net-NTLM Hash information corresponding to the login password of the above target computer;

[0104] The password strength of the target computer is determined through the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer.

[0105] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0106] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0107] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0108] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0109] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0110] The present application also provides a computer program product, which includes computer software instructions. When the computer software instructions are executed on a processing device, the processing device is caused to execute the following Figure 1 The process in the weak password identification method in the corresponding embodiment.

[0111] The above-mentioned computer program product includes one or more computer instructions. When the above-mentioned computer program instructions are loaded and executed on a computer, the above-mentioned process or function according to the embodiment of the present application is generated in whole or in part. The above-mentioned computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above-mentioned computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the above-mentioned computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The above-mentioned computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrated. The above-mentioned available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (solid state disk, SSD)), etc.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0114] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0116] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above-mentioned methods of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0117] In summary, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for identifying weak passwords, characterized in that: include: Identify the communication protocol of the network to which the target computer belongs; In the case where the communication protocol is the SMB protocol, collecting the login password of the target computer through traffic collection technology; Obtain Net-NTLM Hash information corresponding to the login password of the target computer; Determine the password strength of the target computer through the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer; Obtaining account information of the target computer; Obtaining a server account robustness list of the network to which the target computer belongs; In a case where the account information in the server account robustness list includes the account information of the target computer, obtaining the remaining validity time of the account information in the server account robustness list; When the remaining valid time is greater than or equal to the preset time, determining the password strength corresponding to the account information as the password strength of the target computer; In a case where the account information in the server account robustness list does not include the account information of the target computer, determining the remaining validity time of the account information of the target computer based on the password strength of the target computer; The target computer's account information, the target computer's password strength, and the remaining validity time of the target computer's account information are stored in the server account robustness list.

2. The method according to claim 1, characterized in that Also includes: When the login password of the target computer is a weak password, a warning message is issued.

3. The method according to claim 1, characterized in that Also includes: When the communication protocol is not the SMB protocol, a prompt message is issued.

4. The method according to claim 1, characterized in that The obtaining of Net-NTLM Hash information corresponding to the login password of the target computer includes: Obtaining version information of the SMB protocol; Based on the version information and the login password of the target computer, Net-NTLM Hash information of the login password of the target computer corresponding to the version information is acquired.

5. The method according to claim 1, characterized in that The determining of the password strength of the target computer by using the built-in weak password set and the Net-NTLM Hash information corresponding to the login password of the target computer includes: Save the Net-NTLM Hash information corresponding to the login password of the target computer; Using hashcat to crack the Net-NTLMHash information corresponding to the login password of the target computer based on the built-in weak password set; In the case of successful cracking, it is determined that the login password of the target computer is a weak password.

6. A weak password identification device, characterized in that: include: An identification module, used to identify the communication protocol of the network to which the target computer belongs; A collection module, used for collecting the login password of the target computer through traffic collection technology when the communication protocol is the SMB protocol; An acquisition module, used for acquiring Net-NTLM Hash information corresponding to the login password of the target computer; A determination module, used to determine the password strength of the target computer through the Net-NTLMHash information corresponding to the built-in weak password set and the login password of the target computer; Obtaining account information of the target computer; Obtaining a server account robustness list of the network to which the target computer belongs; In a case where the account information in the server account robustness list includes the account information of the target computer, obtaining the remaining validity time of the account information in the server account robustness list; When the remaining valid time is greater than or equal to the preset time, determining the password strength corresponding to the account information as the password strength of the target computer; In a case where the account information in the server account robustness list does not include the account information of the target computer, determining the remaining validity time of the account information of the target computer based on the password strength of the target computer; The target computer's account information, the target computer's password strength, and the remaining validity time of the target computer's account information are stored in the server account robustness list.

7. An electronic device, comprising a memory and a processor, characterized in that: The processor is used to implement the steps of the weak password identification method according to any one of claims 1 to 5 when executing the computer program stored in the memory.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the weak password identification method according to any one of claims 1 to 5 are implemented.

Images