Fix Kerberoast BOF crash on wildcard filters and output truncation

[chryzsh]

Disclaimer

This PR was authored with assistance from an LLM (Claude) and has only been reviewed by that LLM. I discussed this with Dima in the Outflank Slack and we agreed to push it for human review regardless. Please review carefully before merging.

Summary

The Kerberoast BOF crashes the beacon when using wildcard filters that match multiple accounts (e.g. kerberoast roast svc_* against ~28 results). Even when it didn't crash, output was silently truncated for large result sets.

Root Cause

Crash — stale loop state (primary bug): The bResult and bRoast flags were only initialized once before the row iteration loop. When iterating LDAP results, if a user with SPNs was followed by a user without SPNs, bRoast remained TRUE from the previous iteration. This caused the code to attempt Kerberoasting a user whose SPN data was never populated, leading to a NULL pointer dereference and beacon crash.

Crash — NULL stream dereference: BeaconOutputStreamW() could be called after the stream was already released, dereferencing a dangling/invalid pointer. A guard was added to bail out if lpStream is NULL or an invalid sentinel value.

Output truncation: BeaconPrintf has an internal format buffer size limit. When the accumulated IStream content exceeded this limit (common with many tickets), output was silently truncated. This was not immediately obvious because the BOF appeared to succeed.

Changes

1. Reset bResult/bRoast at the top of each row iteration (Kerberoast.c:304-305) — prevents stale state from a previous row from triggering Kerberoast logic on a user with no SPN data.

2. Add NULL/sentinel guard in BeaconOutputStreamW() (Kerberoast.c:54-56) — prevents dereference of released or invalid stream pointers.

3. Chunk the stream flush through BeaconPrintf in 4096-char blocks (Kerberoast.c:66-80) — works around the internal format buffer limit that caused truncation, while keeping BeaconPrintf (which handles wide-char %ls correctly, unlike BeaconOutput which chokes on embedded null bytes in UTF-16).

4. Fix allocation size: cbSize + sizeof(WCHAR) instead of cbSize + 1 (Kerberoast.c:60) — ensures proper space for a wide-char null terminator rather than a single byte.

5. Fix bitwise OR | to logical OR || (Kerberoast.c:397) — in the accountExpires attribute comparison. The bitwise OR worked by accident but was a latent bug.

Test Plan

• Ran kerberoast roast svc_* against a domain with ~28 matching service accounts — previously crashed the beacon, now returns all tickets successfully with no truncation
• Verify kerberoast list still works correctly
• Verify kerberoast roast (single target) still works
• Verify output correctness with AES exclusion filter (/excludeAES)

🤖 Generated with Claude Code