Merritt sank down to lean his back against the wall. Waucheuer and the others had been carrying the heavy-duty breaching kit—the cutting charges and boosters. All Merritt had was a roll of strip explosives, and that wouldn’t take out this steel gate.
Sobol’s voice was right there with him. “Does it help to know that there’s nothing important here?”
Merritt looked down into the watery pit. He examined its walls. They were of brick painted with thick black marine paint. The pit was on the same level as the rest of the cellar—and presumably the server room.
Merritt holstered his pistol and took the remaining grenades from his web harness. He had four flash-bang grenades left. He took the roll of Primasheet and det cord from his thigh pocket and wrapped them tightly around the grenades. Then he stood, straddling the corner of the pit. He dropped the package into the water, reeling out detonator cord as it fell. Then he ducked around the corner and activated the detonator.
The muffled blast shot a geyser of water into the ceiling. The floor trembled for a few moments. Merritt soon heard the sound of water rushing through an opening. He had cracked the brick wall.
He came back to the edge of the pit and could see water draining through the wall and into the server room.
A klaxon suddenly sounded in the house, and fire strobes flickered on the ceiling. A British female voice spoke on a regular PA system, “Primary data center penetrated. Commencing self-destruct sequence.” There was a pause. “And there is no countdown.”
“Shit!” Merritt knew the front door was around the corner and down the front hall. He sprinted around the corner as a piercing beep filled the house. It was like a smoke detector on steroids—drilling into his brain.
The sprinkler caps popped off in the ceiling above him, and sprinkler heads clicked down. He heard the hiss of pressure building up. Merritt looked ahead. The front door of the mansion still stood wide open about a hundred feet ahead—wedged open by that blessed bomb squad team. He sprinted for the opening with everything he had.
The sprinkler heads came to life, spraying gasoline over the stylish décor. He was still sixty feet from the front door when he saw a bright halogen bulb start to burn intensely up near the ceiling in the foyer. The light grew so intense that Merritt couldn’t look directly at it.
When the bulb exploded—sending a wall of flame roaring toward him—Merritt’s brain trotted forward a candidate for his last mortal thought:
I’ll never see my daughters grow up.
Without warning, the floor gave way beneath him as he ran. A pit trap swallowed him. He fell into blackness, chased by flames that lit up the brackish water. Time slowed down, and Merritt had the leisure to consider what a bastard Sobol was; he’d activated a pit trap after letting the bomb disposal robot drive down the hallway safely.
The devious bastard.
Merritt hit the water face-first and blacked out as the trapdoor snapped shut above him.
Among the agents surrounding the mansion a shout went up. It was quickly followed by hundreds of other voices shouting. Sobol’s mansion was now glowing orange. Then flames burst out through literally all of its windows. In seconds the entire structure was engulfed in flames reaching fifty feet into the air. The half-dozen outbuildings burst into flames, too, and were quickly roaring infernos.
Trear numbly watched the scene. It was the nightmarish Waco visual he’d dreaded—one almost certainly combined with the worst casualties ever suffered by the FBI in a single operation. And all of Sobol’s data were going up in flames. Along with Trear’s career.
Chapter 19:// Sarcophagus
It took Gragg nearly three and a half hours to crack the WPA key on Boerner’s second Wi-Fi network. He had to keep his car running the entire time to be certain he didn’t drain his laptop battery. Once he cracked the key, he configured his card to use it, and DHCP soon handed him an IP address on the wireless network. By that time it was roughly four in the morning.
But he’d slept a little, and buoyed by the successful crack, he felt good. If this was a test, he’d passed the first part. He might get out of this alive yet.
Gragg used Superscan to run a ping sweep and port scan for machines on this new network, but he discovered only the single workstation running the wireless access point. The workstation returned information on its operating system and coughed up the status of several running services—but its hard drive was sealed tight.
Gragg considered his options. He wanted a quick exploit that would give him a remote shell on the host machine with sysadmin rights. From there, he should be able to see into the hardwired LAN not yet visible to him.
Since he didn’t have the luxury of time, he opted for an attack that was effective against a wide range of devices: SNMP—a buffer overrun that exploited a known vulnerability in unpatched implementations of Simple Network Management Protocol. This service was present on the target, and it was worth a shot.
He switched to the command console and quickly keyed in the commands, pointing his exploit code to port 161 on the target machine. If the target was running an unpatched OpenBSD, he’d get to root pretty quick.
He executed the command, waited, and in a moment he got a return instructing him to telnet to port 6161 at the target IP address. He sighed in relief. Another hurdle overcome.
Gragg launched a telnet session and soon had a root prompt. He now owned Boerner’s workstation. Time to escalate network privileges.
Gragg searched the target machine’s domain but was disappointed by the results. His victim was linked to a single server—and that was sealed up tight. It barely divulged any information. Gragg took a look in the server’s shared directory and raised his eyebrows.
The directory contained a single Web page file. A page named HackMe.htm.
Gragg smiled. He was beginning to feel a connection with Sobol. Sobol wanted him to get this far—that’s what this was all about.
Gragg double-clicked on the file. A plain white Web page appeared in a browser window. It had logon and password text boxes and a SUBMIT button—nothing more.
There were options here. Unicode directory traversal? Gragg smiled. Logon. Sobol was encouraging him. This had all the earmarks of an SQL-injection attack, and he had a favorite one. In the logon and password boxes he entered:
‘or 1=1--
He clicked the SUBMIT button. After a moment’s pause an animation appeared with the words “Logon successful. Please wait….” Gragg felt a rush of endorphins. He’d just received high praise from his new mentor. He was getting more comfortable by the minute in this environment.
In a few moments a slick Flash-based diagram of a cinderblock building appeared with various features highlighted. It was an isometric view depicting the building right in front of Gragg’s car. He could see the antenna tower with a call-out label captioned “WI-FI ANTENNA ARRAY.” He moved his pointer around the diagram and noticed rollovers come to life as his mouse passed over certain features.
Gragg saw a sensor array depicted on the roof, and the illustration looked like it included at least one camera. Gragg pointed at the array, and a translucent drop-down menu unfolded to the right of it containing a submenu:
Ultrawideband Transceiver
HD Video Multiplexer
Acoustical Sensor Array
He was beginning to feel the rush now. This wasn’t a game, and it was clearly designed by a well-funded and technologically capable person. He had always sought the edge—and this was it. This was as far from Main Street as he’d ever been. This wasn’t the tattooed, pierced, neo-tribal rebellious bullshit of his generation. This was a quiet demonstration of networked power. This was it.