ResetNightmare

Proof-of-concept (POC) tool for ResetNightmare (CVE-2026-27912).

ResetNightmare is a validation flaw in the Kerberos Change Password protocol that allows for resetting the password of any target user/computer account, without knowing the current one. The attack requires an unpatched domain controller, and the ability to write a userPrincipalName (UPN) on any account you control. Alternatively, the vulnerability can also be abused by an attacker having the ability to create new users/computers in any OU, as creating a user/computer allows you to get GenericWrite permissions over it.

Attack flow

This script automates the full attack flow and cleans up after itself. The attack flow is as follows:

1. The attacker has a user or computer that they can write a UPN to. This can either be supplied, or created, using -CreateNewPath.
2. The attacker sets the UPN of the account they control to the sAMAccountName of the target, e.g. "Administrator".
3. The attacker can then request a TGT for the "Administrator" user name, with a name type of NT-ENTERPRISE. This TGT will be requested to the kadmin/changepw SPN.
4. The attacker clears their own UPN, leaving only the target with a UPN that resolved to themself.
5. The attacker then uses the TGT they have to reset the password for the "Administrator" user, without ever knowing the previous value.
6. If the attack succeeds, the target's password has been changed, and the attacker can now authenticate using the new credentials.

Both user and computer accounts can be targeted.

Requirements

• Windows with PowerShell.
• The ActiveDirectory PowerShell module.
• The script uses Rubeus.exe, tested with Rubeus compiled against .NET Framework 4.6.2. Place it in the current directory, or point to it with -RubeusPath.
• Either:
  • A domain account you control and can write a UPN to.
  • Permission to create accounts in an OU/Container (specified with -CreateNewPath).
• An unpatched DC to target. Can be specified with -DC.

Usage

Dot-source the script to load the function, then call it:

. .\ResetNightmare.ps1

Invoke-ResetNightmare `
    -TargetAccount "victim" `
    -TargetNewPassword "NewP@ssw0rd!" `
    -UPNUser "controlledUser" `
    -UPNUserPassword "ControlledP@ss!"

Targeting a computer account

Use the sAMAccountName (ending with $) for -TargetAccount:

Invoke-ResetNightmare `
    -TargetAccount 'server$' `
    -TargetNewPassword "NewP@ssw0rd!" `
    -UPNUser "controlledUser" `
    -UPNUserPassword "ControlledP@ss!"

Creating a new controlled account

If you have permission to create objects in an OU/Container, you can specify the DN to the OU/Container using -CreateNewPath. When it's specified, -UPNUser and -UPNUserPassword are treated as the credentials of the account to create, instead of an existing account in the domain:

Invoke-ResetNightmare `
    -TargetAccount "victim" `
    -TargetNewPassword "NewP@ssw0rd!" `
    -UPNUser "attackerAcct" `
    -UPNUserPassword "AttackerP@ss!" `
    -CreateNewPath "OU=Temp,DC=demo,DC=lab"

Add -Computer to create/use a computer account instead of a user account.

Parameters

DISCLAIMER
This content is provided for educational and informational purposes only. It is intended to promote awareness and responsible remediation of security vulnerabilities that may exist on systems you own or are authorized to test. Unauthorized use of this information for malicious purposes, exploitation, or unlawful access is strictly prohibited. The authors do not endorse or condone any illegal activity and disclaim any liability arising from misuse of the material. Additionally, the authors do not guarantee the accuracy or completeness of the content and assume no liability for any damages resulting from its use.