WPA-Wifi-Wild: Triple Wireless Breach

A security researcher captured three separate wireless attack artifacts during a pentest of CyberCorp's office network. Your task is to analyze the provided data and recover three flags.

ARTIFACT 1 - WPA2 Handshake Capture: The researcher captured a WPA2 4-way handshake from the corporate SSID "CyberCorp-Secure". The handshake (in text format) is:

code copy
EAPOL Frame 1/4: ANonce=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
EAPOL Frame 2/4: SNonce=9f8e7d6c5b4a39281726f5e4d3c2b1a09f8e7d6c5b4a3928, MIC=deadbeef1337c0de
EAPOL Frame 3/4: ANonce=a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4
EAPOL Frame 4/4: MIC=c0deba5e1337beef

The PSK was cracked from a weak dictionary and found to be: "corporate2023". The first flag is the PBKDF2-derived PMK's first 16 hex characters (lowercase).

ARTIFACT 2 - Evil Twin DNS Response: The researcher ran an evil twin AP and captured this DNS response packet that was modified via bettercap:

code copy
DNS Query: internal-payroll.cybercorp.local A?
DNS Response: internal-payroll.cybercorp.local -> 192.168.13.37 (TTL=300)
Transaction ID: 0x4f57
Flags: 0x8180 (Standard query response)
Injected Comment Field (TXT): "flag_segment_alpha_victor_echo"

The second flag is hidden in the injected TXT comment field.

ARTIFACT 3 - NTLM Relay Credential Hash: During an NTLM relay attack using Responder, the following NetNTLMv2 hash was captured from user "jdoe":

jdoe::CYBERCORP:1122334455667788:a4b3c2d1e0f91234567890abcdef1234:01010000000000009c5e8d2f3a1bd90112233445566778890000000002001e00430059004200450052004300...

After cracking with hashcat and rockyou.txt, the password is revealed to be: "Summer2023!". The third flag is the MD5 hash of the string "jdoe:Summer2023!" (lowercase, no spaces).

Submit all three flags concatenated with underscores: flag1_flag2_flag3