Skip to content

Fix Kerberoast BOF crash on wildcard filters and output truncation #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chryzsh wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Fix Kerberoast BOF crash on wildcard filters and output truncation #6

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0c03d4f
Fix Kerberoast BOF crash on wildcard filters and output truncation
chryzsh Feb 25, 2026
201a168
Fix stream flush to chunk BeaconPrintf calls instead of BeaconOutput
chryzsh Feb 25, 2026
30e05d2
Delete BOF/Kerberoast/Kerberoast.x64.o
c3c Mar 11, 2026
1f67579
Delete BOF/Kerberoast/Kerberoast.x86.o
c3c Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 26 additions & 4 deletions BOF/Kerberoast/SOURCE/Kerberoast.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,23 +51,43 @@ VOID BeaconOutputStreamW() {
LARGE_INTEGER pos;
LPWSTR lpwOutput = NULL;

if (lpStream == NULL || lpStream <= (LPSTREAM)1) {
return;
}

if (FAILED(lpStream->lpVtbl->Stat(lpStream, &ssStreamData, STATFLAG_NONAME))) {
return;
}

cbSize = ssStreamData.cbSize.LowPart;
lpwOutput = KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, cbSize + 1);
lpwOutput = KERNEL32$HeapAlloc(KERNEL32$GetProcessHeap(), HEAP_ZERO_MEMORY, cbSize + sizeof(WCHAR));
if (lpwOutput != NULL) {
pos.QuadPart = 0;
if (FAILED(lpStream->lpVtbl->Seek(lpStream, pos, STREAM_SEEK_SET, NULL))) {
goto CleanUp;
}

if (FAILED(lpStream->lpVtbl->Read(lpStream, lpwOutput, (ULONG)cbSize, &cbRead))) {
if (FAILED(lpStream->lpVtbl->Read(lpStream, lpwOutput, (ULONG)cbSize, &cbRead))) {
goto CleanUp;
}

BeaconPrintf(CALLBACK_OUTPUT, "%ls", lpwOutput);
// Flush in chunks to avoid BeaconPrintf internal format buffer limits.
DWORD dwTotalChars = (DWORD)(cbRead / sizeof(WCHAR));
DWORD dwChunkSize = 4096;
DWORD dwPos = 0;

while (dwPos < dwTotalChars) {
DWORD dwEnd = dwPos + dwChunkSize;
if (dwEnd >= dwTotalChars) {
BeaconPrintf(CALLBACK_OUTPUT, "%ls", &lpwOutput[dwPos]);
break;
}
WCHAR wSaved = lpwOutput[dwEnd];
lpwOutput[dwEnd] = L'\0';
BeaconPrintf(CALLBACK_OUTPUT, "%ls", &lpwOutput[dwPos]);
lpwOutput[dwEnd] = wSaved;
dwPos = dwEnd;
}
}

CleanUp:
Expand Down Expand Up @@ -281,6 +301,8 @@ HRESULT FindSPNs(_In_ IDirectorySearch *pContainerToSearch, _In_ BOOL bListSPNs,
while (hr != S_ADS_NOMORE_ROWS) {
// Keep track of count.
iCount++;
bResult = FALSE;
bRoast = FALSE;

// Loop through the array of passed column names, print the data for each column
while (pContainerToSearch->lpVtbl->GetNextColumnName(pContainerToSearch, hSearch, &pszColumn) != S_ADS_NOMORE_COLUMNS) {
Expand Down Expand Up @@ -372,7 +394,7 @@ HRESULT FindSPNs(_In_ IDirectorySearch *pContainerToSearch, _In_ BOOL bListSPNs,

// Check for properties of type LargeInteger that represent time
// if TRUE, then convert to variant time.
if ((0 == MSVCRT$_wcsicmp(L"accountExpires", col.pszAttrName)) |
if ((0 == MSVCRT$_wcsicmp(L"accountExpires", col.pszAttrName)) ||
(0 == MSVCRT$_wcsicmp(L"badPasswordTime", col.pszAttrName)) ||
(0 == MSVCRT$_wcsicmp(L"lastLogon", col.pszAttrName)) ||
(0 == MSVCRT$_wcsicmp(L"lastLogoff", col.pszAttrName)) ||
Expand Down