Gragg used Superscanto run a ping sweep and port scan for machines on this new network, but he discovered only the single workstation running the wireless access point. The workstation returned information on its operating system and coughed up the status of several running services-but its hard drive was sealed tight.
Gragg considered his options. He wanted a quick exploit that would give him a remote shell on the host machine with sysadmin rights. From there, he should be able to see into the hardwired LAN not yet visible to him.
Since he didn't have the luxury of time, he opted for an attack that was effective against a wide range of devices: SNMP-a buffer overrun that exploited a known vulnerability in unpatched implementations of Simple Network Management Protocol. This service was present on the target, and it was worth a shot.
He switched to the command console and quickly keyed in the commands, pointing his exploit code to port 161 on the target machine. If the target was running an unpatched OpenBSD, he'd get to root pretty quick.
He executed the command, waited, and in a moment he got a return instructing him to telnet to port 6161 at the target IP address. He sighed in relief. Another hurdle overcome.
Gragg launched a telnet session and soon had a root prompt. He now owned Boerner's workstation. Time to escalate network privileges.
Gragg searched the target machine's domain but was disappointed by the results. His victim was linked to a single server-and that was sealed up tight. It barely divulged any information. Gragg took a look in the server's shared directory and raised his eyebrows.
The directory contained a single Web page file. A page named HackMe.htm.
Gragg smiled. He was beginning to feel a connection with Sobol. Sobol wanted him to get this far-that's what this was all about.
Gragg double-clicked on the file. A plain white Web page appeared in a browser window. It had logon and password text boxes and a SUBMIT button-nothing more.
There were options here. Unicode directory traversal? Gragg smiled. Logon.Sobol was encouraging him. This had all the earmarks of an SQL-injection attack, and he had a favorite one. In the logon and password boxes he entered:
'or 1=1-
He clicked the SUBMIT button. After a moment's pause an animation appeared with the words "Logon successful. Please wait…" Gragg felt a rush of endorphins. He'd just received high praise from his new mentor. He was getting more comfortable by the minute in this environment.
In a few moments a slick Flash-based diagram of a cinderblock building appeared with various features highlighted. It was an isometric view depicting the building right in front of Gragg's car. He could see the antenna tower with a call-out label captioned "WI-FI ANTENNA ARRAY." He moved his pointer around the diagram and noticed rollovers come to life as his mouse passed over certain features.
Gragg saw a sensor array depicted on the roof, and the illustration looked like it included at least one camera. Gragg pointed at the array, and a translucent drop-down menu unfolded to the right of it containing a submenu:
Ultrawideband Transceiver
HD Video Multiplexer
Acoustical Sensor Array
He was beginning to feel the rush now. This wasn't a game, and it was clearly designed by a well-funded and technologically capable person. He had always sought the edge — and this was it. This was as far from Main Street as he'd ever been. This wasn't the tattooed, pierced, neo-tribal rebellious bullshit of his generation. This was a quiet demonstration of networked power. This was it.
Gragg selected HD Video Multiplexerfrom the drop-down menu. A new browser window appeared containing a selection of six thumbnail images. They appeared to be streaming video feeds. Gragg saw an image of a car in one thumbnail, and he double-clicked on it-as anyone his age would do. It expanded to fill the window. It was a live image of his car. He waved his hand, and his hand appeared waving on the video feed. Gragg noticed a superimposed red bracket around his license plate. A call-out label showed the software's interpretation of the tag number. It was correct. So Sobol was employing an optical license plate reader. Gragg knew it was commercially available software-used all the time on interstates and downtown roads. But Sobol needed access to DMV records to determine who owned the car. He must have cracked a DMV database in order to get his registration information. Gragg considered the hourly rate of the average DMV worker and realized that gaining access wasn't a problem for Sobol.
In the background of the video, there was a similar bracket around the VW Vanagon's license plate. Gragg couldn't help but wonder what was up with that. The van was smashed all to hell.
He closed that dialog box and checked out the other video feeds. There were cameras placed all around the cinderblock building, guarding it from every direction. Every time the wind blew, the swaying branches were outlined by vectored lines trying to resolve into something recognized by the software. Gragg found himself watching the red lines appear and disappear like a lava lamp. Motion-capture software? This was sophisticated stuff. No one would ever suspect that this isolated blockhouse held so much processing power.
Gragg closed the video feeds and moved around to the other visible features of the diagram. He noticed that a garage-like protrusion extended from the rear of the building. He pointed his mouse at it, and the words "H1 Alpha" materialized beneath his pointer. That explained the damage to the Vanagon. There was an automated Hummer here-just like at Sobol's mansion. Gragg smiled. It was Sobol. He was walking in the footsteps of a genius. To his dismay, there was no more information visible for the Hummer, so he clicked on one of the nodes around the base of the building. The label "Seismic Sensors" appeared. Probably for detection of approaching vehicles and people.
As Gragg scrolled around the base of the building illustration, a rollover displayed the red, glowing outline of a door in the front wall. He looked up at the real wall some twenty feet ahead of him. He couldn't see any indication that there was a door in the plain cinder blocks. He hovered his mouse cursor back over the section of wall in the diagram, and a drop-down menu appeared. It had two selections: «Open» and "Close." Gragg clicked "Open."
In front of his car, he saw a section of the cinderblock wall move inward and then slide sideways-revealing a dark doorway about five feet wide. Gragg half expected roiling steam to emanate from the opening. It was outlined with a soft red glow.
Was this it? Was he supposed to enter? He looked around warily. That would require getting out of his car.
The spotlight from the building still shined down on the area, revealing what a horrendous morass of mud he'd driven into. He had no idea how he'd get the car out without a tow truck. He couldn't stay in here forever.
Gragg shut down his laptop and packed up all his gear. In a few minutes he had everything in his rucksack except for his Glock 9mm-which he kept in his right hand. Gragg opened the Tempo's driver door with its trademark 1980s-Detroit-crack-squeak sound. He gingerly placed one combat-booted foot into the quagmire and felt it sink up to his knee. He groaned in disgust, but realizing he had no choice, he followed it with his other foot, closing the car door behind him. Pretty soon he was stagger-stepping through the deep mud toward the dark opening in the cinderblock wall.
Gragg stopped and took another look at the smashed VW Vanagon with Louisiana plates and anarchy bumper stickers. Shattered taillight plastic and twisted side moldings littered the area. The left rear wheel of the VW was smashed into immobility, set at an angle to the axle. The passenger door of the Vanagon was slightly open, with deep footprints leading out of the mud and toward the road.
Gragg stood for a moment, deciding whether to check it out. He realized he didn't want to be walking around out here and continued staggering through the foot-sucking mud toward the building.