Michael Prescott - Last Breath

She attacked the hole with the hammer’s claw, peeling off chips of wood. Six inches wide now.

Gunshot.

It thundered in the crawl space, the blast of a pistol.

Adam had fired at her.

And missed. He was still outside, far away, and she was dimly illuminated and half-hidden by the plumbing.

Still, he might not miss again.

She gave up using the claw and pounded the edges of the hole, breaking off chunks of plywood that pattered on the gravel where she lay.

Twelve inches wide now.

Adam fired again. She heard the pistol’s report and the bullet’s ricochet in the same instant.

The shot had struck the plumbing pipes behind her.

She was pushing her luck. Needed to get out of here right now.

Another swing of the hammer, and something snapped.

The hammer. Its head had broken off.

And the hole was still too narrow.

A third shot. Gravel sprayed her face. The round had landed close.

And the fumes were reaching her now. She started coughing again. Her eyes watered.

“You’re not getting out, C.J.!” Adam screamed.

She wanted to tell him to fuck himself, but she didn’t have any air in her lungs, only sawdust and toxins.

Had to widen the hole, or she was dead. No hammer. Okay, improvise.

She braced herself against the copper pipes, then pistoned her legs upward, slamming her sneakers into the subfloor.

Loose wood at the rim of the hole broke away. She kicked again. More debris.

The hole was wide enough now. She twisted into a crouch and grabbed the edges of the hole, ignoring the bite of splinters in her palms. She pulled herself up.

Gunshots behind her. She didn’t think she’d been hit. Couldn’t be sure. Veteran cops had told her that sometimes you took a bullet and didn’t feel it till you saw the blood, touched the wound.

She hoisted herself all the way out, into a corner room with two windows letting in the moonlight.

Knelt for a moment, wheezing, fighting for air until her lungs were clear and she could raise her head and see where she was.

It was a kitchen. A break room, more accurately, for the benefit of the office workers who would inhabit this building. Sink, dishwasher, counter space. The floor was parquet, lustrous in the moonlight, a small touch of elegance that explained the plywood subfloor. Parquet flooring on a concrete base would absorb moisture from the stone, then buckle and fail. Another thing the building inspector had told her.

She struggled to her feet, unlocked a window and raised it. An alarm went off. Every building in the complex must be wired. It was okay. Adam already knew she was inside.

She glanced again at the floor-so shiny-then at two cans with hinged metal handles resting in a corner. She sniffed them both, then picked up the second one and hauled it through the window as she climbed out.

Adam was coming. She could see the brightening glow of the BMW’s headlights.

She ran, lugging the can. It was heavy, gallon-sized, and it slowed her down, but she would not abandon it.

It might be just what she needed to turn this battle in her favor-and give her ex-husband a very nasty surprise.

“So how do we get in?” Brand asked, pacing the office while a cold wind howled and bleated outside. “We don’t have time for a low-and-slow, and if we bombard them, they’ll get their guard up right away.”

“I know,” Rawls said, staring at the homepage of the cellular phone company whose server he had to break into.

There were two obvious methods of testing a company’s perimeter defenses. Low-and-slow port scanning was one way. Data packets, small enough to be missed by most intrusion-detection software, were sent to the corporate network over a period of days. Entry was accomplished by flying under the radar and taking a long time-low and slow. Eventually all open ports would be identified, and a skilled hacker could map the network.

The alternative was to bombard the target with data packets-an NMap FIN scan, in hacker argot. There was nothing slow about this approach, but unfortunately it wasn’t clandestine either. An all-out scanning attack would trigger an immediate security alert.

Rawls needed to get in fast but surreptitiously. Tall order, but there was always a way.

His fingers moved across his keyboard and pulled up a program that allowed him to launch a null session-a NetBIOS connection established with a blank user name and password. A null session could get him into any vulnerable server and allow him to read some of its contents.

“You can’t get to Nolan’s account that way,” Brand said, watching over his shoulder.

“I’m aware of that, Ned.” Rawls heard testiness in his own voice. Well, it was after 2:00 A.M. He had a right to be testy.

The null session got him into the corporate server and gave him read-only access to the registry. “They’re running NT 4.0,” he said, “service pack five, option pack four.”

“Outdated,” Brand observed.

“That’s what I was hoping for. You remember the problem with this build of NT?”

“There were lots of problems.”

“The big one.”

“You mean the i-i-s-hack thing?”

“You got it.”

“There’s been a patch for that since last year.”

“But if the sysadmin hasn’t upgraded his OS, he may not have kept current on the patches either.” Rawls was already searching his hard drive for a file named “ncx. exe.” He uploaded it to the Baltimore field office’s Web site, then typed a telnet command, sending a 500-byte file-a small program called “iis-hack”-to port 80 of the cell-phone company’s Web server. The port was open, as it had to be in order to receive Internet traffic. The question was: Would it run the program, or had the server been upgraded with a security patch that would reject the file?

“No way they didn’t patch it,” Brand said.

“There are hundreds of holes in NT,” Rawls countered. “No one can patch them all.”

“Don’t even need a patch, really. Sysadmin just has to disable script mapping for. HTR files.”

“Well, let’s hope he didn’t.”

They waited. The “iishack” program would instruct the server to find the “ncx. exe” file at the Baltimore field office’s URL. It would take a couple of minutes for the file to be downloaded and run. Or the request might already have been denied.

When two and a half minutes had passed according to Rawls’s wristwatch, he entered a new telnet command and reconnected with port 80 of the victim server.

“Moment of truth,” Brand said, leaning closer to the screen.

The corporate homepage vanished, replaced by a black screen with the copyright notice for Windows NT. Below it flashed a DOS prompt.

“We’re in,” Rawls breathed. The flickering C:\ looked beautiful to him.

He was past the firewall. He had access to the corporate server.

Quickly he scrolled through the directory, then went to accounts, entering the Read command followed by Adam Nolan’s account number, which was probably the filename.

A request for log-on identification came up.

“Shit.” Brand sighed. “I guess their security’s not as lame as I thought.”

“We can crack it.” Rawls returned to the directory and located a list of user names. No passwords were shown, but he didn’t think he’d need one. He scanned the list until he found the user name backup. He tapped it with his fingertip. “Sounds like a back door.”

Brand agreed. “Give it a shot.”

Back doors were simple means of access left in place by maintenance and diagnostic personnel who didn’t want to be bothered with memorizing complicated user IDs and passwords. Often they left the manufacturer’s default settings intact. Even when they modified the settings, the changes were usually easy to guess.