ADCS certihound collection intermittently fails with ASN1 error under Kerberos auth #1175

Describe the bug
When using Kerberos authentication with BloodHound collection (--bloodhound --collection All), the ADCS collection portion can intermittently fail with ASN1 parsing errors. The suspected root cause is in Impacket's LDAP recv_raw() method — the GSSAPI frame reassembly loop condition reads excessive data when initial receives contain more bytes than the first frame's length, resulting in corrupted decrypted data that fails ASN1 validation.

To Reproduce
Steps to reproduce the behavior:
Command: KRB5CCNAME=<ccache> nxc ldap <dc> --use-kcache --bloodhound --collection All --dns-server <dns>
Resulted in:

ADCS collection failed: <TagSet object, tags 64:0:21> not in asn1Spec: <LDAPMessage schema object...>

Similar ASN1 tag errors may also appear as 192:0:8 or other variations.

Note: This issue has proven difficult to consistently reproduce. It was initially observed during Kerberos-authenticated ADCS enumeration but could not be reliably triggered on subsequent attempts against the same and different environments. The failure may depend on LDAP response size, timing, or other network conditions.

Expected behavior
ADCS certificate template and enterprise CA enumeration should complete successfully when using Kerberos authentication, the same as it does with NTLM/password authentication.

Screenshots

NetExec info

• OS: Kali
• Version of nxc: latest from GitHub (main branch)
• Installed from: github
• Target: Windows Server 2022 (Build 20348) — observed on HTB Ghost machine
• Auth method: Kerberos (GSSAPI)

Additional context

• The issue appears to be in Impacket's GSSAPI LDAP implementation, not in NetExec directly.
• Documenting for future tracking as requested by @NeffIsBack in PR Fix ADCS certihound collection failing with Kerberos auth (GSSAPI ASN1 error) #1170.