Full download ebooks at https://ebookmeta.

com

Black Hat Rust Deep dive into offensive

security with the Rust programming language
Sylvain Kerkour

For dowload this book click link below

https://ebookmeta.com/product/black-hat-rust-deep-dive-into-
offensive-security-with-the-rust-programming-language-
sylvain-kerkour/

OR CLICK BUTTON

DOWLOAD NOW
More products digital (pdf, epub, mobi) instant
download maybe you interests ...

Black Hat Rust Applied offensive security with the Rust

programming language Sylvain Kerkour

https://ebookmeta.com/product/black-hat-rust-applied-offensive-
security-with-the-rust-programming-language-sylvain-kerkour-2/

Black Hat Rust Applied offensive security with the Rust

programming language Sylvain Kerkour

https://ebookmeta.com/product/black-hat-rust-applied-offensive-
security-with-the-rust-programming-language-sylvain-kerkour-3/

Black Hat Rust Applied offensive security with the Rust

programming language Sylvain Kerkour

https://ebookmeta.com/product/black-hat-rust-applied-offensive-
security-with-the-rust-programming-language-sylvain-kerkour/

Black Hat Rust Sylvain Kerkour

https://ebookmeta.com/product/black-hat-rust-sylvain-kerkour/
The Rust Programming Language Steve Klabnik

https://ebookmeta.com/product/the-rust-programming-language-
steve-klabnik/

The Rust Programming Language 2nd Edition Steve Klabnik

https://ebookmeta.com/product/the-rust-programming-language-2nd-
edition-steve-klabnik/

The Rust Programming Language, Second Edition Steve

Klabnik

https://ebookmeta.com/product/the-rust-programming-language-
second-edition-steve-klabnik/

Beginning Rust: Get Started with Rust 2021 Edition

Carlo Milanesi

https://ebookmeta.com/product/beginning-rust-get-started-with-
rust-2021-edition-carlo-milanesi/

Beginning Rust Programming 1st Edition Ric Messier

https://ebookmeta.com/product/beginning-rust-programming-1st-
edition-ric-messier/
Black Hat Rust
Applied offensive security with the Rust
programming language

Sylvain Kerkour
 Black Hat Rust
Deep dive into offensive security with the Rust programming
language

Sylvain Kerkour

v2021.23
Contents

1 Copyright 8

2 Your early access bonuses 9

3 Beta & Contact 10

4 Preface 11

5 Introduction 14
5.1 Types of attacks . . . . . . . . . . . . . . . . . . . . . . . . . 15
5.2 Phases of an attack . . . . . . . . . . . . . . . . . . . . . . . . 17
5.3 Profiles of attackers . . . . . . . . . . . . . . . . . . . . . . . . 18
5.4 Attribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.5 The Rust programming language . . . . . . . . . . . . . . . . 20
5.6 History of Rust . . . . . . . . . . . . . . . . . . . . . . . . . . 20
5.7 Rust is awesome . . . . . . . . . . . . . . . . . . . . . . . . . 22
5.8 Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.9 Our first Rust program: A SHA-1 hash cracker . . . . . . . . 26
5.10 Mental models to approach Rust . . . . . . . . . . . . . . . . 33
5.11 A few things I’ve learned along the way . . . . . . . . . . . . . 35
5.12 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

6 Multi-threaded attack surface discovery 45

6.1 Passive reconnaissance . . . . . . . . . . . . . . . . . . . . . . 46
6.2 Active reconnaissance . . . . . . . . . . . . . . . . . . . . . . . 46
6.3 Assets discovery . . . . . . . . . . . . . . . . . . . . . . . . . . 47
6.4 Our first scanner in Rust . . . . . . . . . . . . . . . . . . . . . 48
6.5 Error handling . . . . . . . . . . . . . . . . . . . . . . . . . . 49

1
 6.6 Enumerating subdomains . . . . . . . . . . . . . . . . . . . . 49
6.7 Scanning ports . . . . . . . . . . . . . . . . . . . . . . . . . . 50
6.8 Multithreading . . . . . . . . . . . . . . . . . . . . . . . . . . 52
6.9 Fearless concurrency in Rust . . . . . . . . . . . . . . . . . . . 53
6.10 The three causes of data races . . . . . . . . . . . . . . . . . . 56
6.11 The three rules of ownership . . . . . . . . . . . . . . . . . . . 56
6.12 The two rules of references . . . . . . . . . . . . . . . . . . . . 56
6.13 Adding multithreading to our scanner . . . . . . . . . . . . . . 56
6.14 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

7 Going full speed with async 61

7.1 Why . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
7.2 Cooperative vs Preemptive scheduling . . . . . . . . . . . . . 62
7.3 Future . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
7.4 Streams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
7.5 What is a runtime . . . . . . . . . . . . . . . . . . . . . . . . 63
7.6 Introducing tokio . . . . . . . . . . . . . . . . . . . . . . . . . 64
7.7 Sharing data . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
7.8 Avoid blocking . . . . . . . . . . . . . . . . . . . . . . . . . . 67
7.9 Combinators . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
7.10 Porting our scanner to async . . . . . . . . . . . . . . . . . . . 80
7.11 How to defend . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
7.12 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

8 Adding modules with trait objects 82

8.1 Generics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
8.2 Traits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
8.3 Traits objects . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
8.4 Command line argument parsing . . . . . . . . . . . . . . . . 93
8.5 Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
8.6 Adding modules to our scanner . . . . . . . . . . . . . . . . . 95
8.7 Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103
8.8 Other scanners . . . . . . . . . . . . . . . . . . . . . . . . . . 107
8.9 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

9 Crawling the web for OSINT 108

9.1 OSINT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
9.2 Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

2
 9.3 Search engines . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
9.4 IoT & network Search engines . . . . . . . . . . . . . . . . . . 111
9.5 Social media . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
9.6 Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
9.7 Videos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
9.8 Government records . . . . . . . . . . . . . . . . . . . . . . . 112
9.9 Crawling the web . . . . . . . . . . . . . . . . . . . . . . . . . 113
9.10 Why Rust for crawling . . . . . . . . . . . . . . . . . . . . . . 115
9.11 Associated types . . . . . . . . . . . . . . . . . . . . . . . . . 115
9.12 Atomic types . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
9.13 Barrier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
9.14 Implementing a crawler in Rust . . . . . . . . . . . . . . . . . 118
9.15 The spider trait . . . . . . . . . . . . . . . . . . . . . . . . . . 118
9.16 Implementing the crawler . . . . . . . . . . . . . . . . . . . . 118
9.17 Crawling a simple HTML website . . . . . . . . . . . . . . . . 122
9.18 Crawling a JSON API . . . . . . . . . . . . . . . . . . . . . . 124
9.19 Crawling a JavaScript web application . . . . . . . . . . . . . 127
9.20 How to defend . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
9.21 Going further . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
9.22 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

10 Finding vulnerabilities 133

10.1 What is a vulnerability . . . . . . . . . . . . . . . . . . . . . . 133
10.2 CWE vs CVE . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
10.3 Vulnerability vs Exploit . . . . . . . . . . . . . . . . . . . . . 134
10.4 0 Day vs CVE . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
10.5 Web vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . 135
10.6 Injections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
10.7 HTML injection . . . . . . . . . . . . . . . . . . . . . . . . . . 135
10.8 SQL injection . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
10.9 XSS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
10.10Server Side Request Forgery (SSRF) . . . . . . . . . . . . . . 142
10.11Cross-Site Request Forgery (CSRF) . . . . . . . . . . . . . . . 144
10.12Open redirect . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
10.13(Sub)Domain takeover . . . . . . . . . . . . . . . . . . . . . . 147
10.14Arbitrary file read . . . . . . . . . . . . . . . . . . . . . . . . 148
10.15Denial of Service (DoS) . . . . . . . . . . . . . . . . . . . . . . 150
10.16Arbitrary file write . . . . . . . . . . . . . . . . . . . . . . . . 152

3
 10.17Memory vulnerabilities . . . . . . . . . . . . . . . . . . . . . . 153
10.18Buffer overflow . . . . . . . . . . . . . . . . . . . . . . . . . . 154
10.19Use after free . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
10.20Double free . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
10.21Format string problems . . . . . . . . . . . . . . . . . . . . . . 157
10.22Other vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . 157
10.23Remote Code Execution (RCE) . . . . . . . . . . . . . . . . . 157
10.24Integer overflow (and underflow) . . . . . . . . . . . . . . . . . 159
10.25Logic error . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
10.26Race condition . . . . . . . . . . . . . . . . . . . . . . . . . . 161
10.27Additional resources . . . . . . . . . . . . . . . . . . . . . . . 161
10.28Bug hunting . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
10.29The tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164
10.30Automated audits . . . . . . . . . . . . . . . . . . . . . . . . . 166
10.31Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

11 Exploit development 172

11.1 Creating a crate that is both a library and a binary . . . . . . 172
11.2 Building our pwntoolkit . . . . . . . . . . . . . . . . . . . . . 172
11.3 CVE-2017-9506 . . . . . . . . . . . . . . . . . . . . . . . . . . 173
11.4 CVE-2018-7600 . . . . . . . . . . . . . . . . . . . . . . . . . . 173
11.5 CVE-2019-11229 . . . . . . . . . . . . . . . . . . . . . . . . . 175
11.6 CVE-2019-89242 . . . . . . . . . . . . . . . . . . . . . . . . . 180
11.7 CVE-2021-3156 . . . . . . . . . . . . . . . . . . . . . . . . . . 186
11.8 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

12 Writing shellcodes in Rust 191

12.1 What is a shellcode . . . . . . . . . . . . . . . . . . . . . . . . 191
12.2 Sections of an executable . . . . . . . . . . . . . . . . . . . . . 193
12.3 Rust compilation process . . . . . . . . . . . . . . . . . . . . . 193
12.4 no_std . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
12.5 Using assembly from Rust . . . . . . . . . . . . . . . . . . . . 196
12.6 The never type . . . . . . . . . . . . . . . . . . . . . . . . . . 197
12.7 Executing shellcodes . . . . . . . . . . . . . . . . . . . . . . . 198
12.8 Our linker script . . . . . . . . . . . . . . . . . . . . . . . . . 199
12.9 Hello world shellcode . . . . . . . . . . . . . . . . . . . . . . . 200
12.10An actual shellcode . . . . . . . . . . . . . . . . . . . . . . . . 203

4
 12.11Reverse TCP shellcode . . . . . . . . . . . . . . . . . . . . . . 210
12.12Going further . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
12.13Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

13 Phishing with WebAssembly 215

13.1 Social engineering . . . . . . . . . . . . . . . . . . . . . . . . . 215
13.2 Nontechnical hacks . . . . . . . . . . . . . . . . . . . . . . . . 220
13.3 Phishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
13.4 Watering holes . . . . . . . . . . . . . . . . . . . . . . . . . . 222
13.5 Evil twin attack . . . . . . . . . . . . . . . . . . . . . . . . . . 225
13.6 Telephone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
13.7 WebAssembly . . . . . . . . . . . . . . . . . . . . . . . . . . . 227
13.8 Sending emails in Rust . . . . . . . . . . . . . . . . . . . . . . 227
13.9 Implementing a phishing page in Rust . . . . . . . . . . . . . 233
13.10Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
13.11Cargo Workspaces . . . . . . . . . . . . . . . . . . . . . . . . 234
13.12Deserialization in Rust . . . . . . . . . . . . . . . . . . . . . . 234
13.13A client application with WebAssembly . . . . . . . . . . . . . 235
13.14How to defend . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
13.15Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

14 A modern RAT 247

14.1 Architecture of a RAT . . . . . . . . . . . . . . . . . . . . . . 248
14.2 Existing RAT . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
14.3 Why Rust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253
14.4 Designing the server . . . . . . . . . . . . . . . . . . . . . . . 254
14.5 Designing the agent . . . . . . . . . . . . . . . . . . . . . . . . 264
14.6 Docker for offensive security . . . . . . . . . . . . . . . . . . . 265
14.7 Let’s code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266
14.8 Optimizing Rust’s binary size . . . . . . . . . . . . . . . . . . 284
14.9 Some limitations . . . . . . . . . . . . . . . . . . . . . . . . . 285
14.10Distributing you RAT . . . . . . . . . . . . . . . . . . . . . . 286
14.11Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

15 Securing communications with end-to-end encryption 287

15.1 The C.I.A triad . . . . . . . . . . . . . . . . . . . . . . . . . . 288
15.2 Threat modeling . . . . . . . . . . . . . . . . . . . . . . . . . 289
15.3 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

5
 15.4 Hash functions . . . . . . . . . . . . . . . . . . . . . . . . . . 290
15.5 Message Authentication Codes . . . . . . . . . . . . . . . . . . 291
15.6 Key derivation functions . . . . . . . . . . . . . . . . . . . . . 292
15.7 Block ciphers . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
15.8 Authenticated encryption . . . . . . . . . . . . . . . . . . . . 293
15.9 Asymmetric encryption . . . . . . . . . . . . . . . . . . . . . . 296
15.10Key exchanges . . . . . . . . . . . . . . . . . . . . . . . . . . 296
15.11Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
15.12End-to-end encryption . . . . . . . . . . . . . . . . . . . . . . 298
15.13Who use cryptography . . . . . . . . . . . . . . . . . . . . . . 299
15.14Common problems and pitfalls with cryptography . . . . . . . 301
15.15A little bit of TOFU? . . . . . . . . . . . . . . . . . . . . . . 302
15.16The Rust cryptography ecosystem . . . . . . . . . . . . . . . . 303
15.17ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303
15.18Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305
15.19Our threat model . . . . . . . . . . . . . . . . . . . . . . . . . 305
15.20Designing our protocol . . . . . . . . . . . . . . . . . . . . . . 306
15.21Implementing end-to-end encryption in Rust . . . . . . . . . . 310
15.22Some limitations . . . . . . . . . . . . . . . . . . . . . . . . . 320
15.23To learn more . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
15.24Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322

16 Going multi-platforms 323

16.1 Why multi-platform . . . . . . . . . . . . . . . . . . . . . . . 323
16.2 Cross-platform Rust . . . . . . . . . . . . . . . . . . . . . . . 324
16.3 Supported platforms . . . . . . . . . . . . . . . . . . . . . . . 325
16.4 Cross-compilation . . . . . . . . . . . . . . . . . . . . . . . . . 326
16.5 cross . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326
16.6 Custom Dockerfiles . . . . . . . . . . . . . . . . . . . . . . . . 328
16.7 Cross-compiling to aarch64 (arm64) . . . . . . . . . . . . . . . 329
16.8 More Rust binary optimization tips . . . . . . . . . . . . . . . 330
16.9 Packers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
16.10Persistence . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332
16.11Single instance . . . . . . . . . . . . . . . . . . . . . . . . . . 337
16.12Going further . . . . . . . . . . . . . . . . . . . . . . . . . . . 337
16.13Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

17 Turning our RAT into a worm to increase reach 338

6
 17.1 What is a worm . . . . . . . . . . . . . . . . . . . . . . . . . . 338
17.2 Spreading techniques . . . . . . . . . . . . . . . . . . . . . . . 338
17.3 Cross-platform worm . . . . . . . . . . . . . . . . . . . . . . . 341
17.4 Vendoring dependencies . . . . . . . . . . . . . . . . . . . . . 342
17.5 Spreading through SSH . . . . . . . . . . . . . . . . . . . . . . 343
17.6 Implementing a cross-platform worm in Rust . . . . . . . . . . 343
17.7 Install . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344
17.8 Spreading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
17.9 More advanced techniques for your RAT . . . . . . . . . . . . 349
17.10Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

18 Conclusion 354
18.1 What we didn’t cover . . . . . . . . . . . . . . . . . . . . . . . 354
18.2 The future of Rust . . . . . . . . . . . . . . . . . . . . . . . . 356
18.3 Leaked repositories . . . . . . . . . . . . . . . . . . . . . . . . 357
18.4 How bad guys get caught . . . . . . . . . . . . . . . . . . . . 357
18.5 Your turn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357
18.6 Build your own RAT . . . . . . . . . . . . . . . . . . . . . . . 361
18.7 Social media . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362
18.8 Other interesting blogs . . . . . . . . . . . . . . . . . . . . . . 362
18.9 Feedback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362

7
Chapter 1

Copyright

Copyright © 2021 Sylvain Kerkour

All rights reserved. No portion of this book may be reproduced in any form
without permission from the publisher, except as permitted by law. For
permissions contact: [email protected]

8
Chapter 2

Your early access bonuses

Dear reader, in order to thank you for buying the Black Hat Rust early access
edition and helping to make this book a reality, I prepared you a special
bonus: I curated a list of the best detailed analyses of the most advanced
malware of the past two decades. You may find inside great inspiration when
developing your own offensive tools. You can find the list at this address:
https://github.com/black-hat-rust-bonuses/black-hat-rust-bonuses
If you notice a mistake (it happens), something that could be improved,
or want to share your ideas about offensive security, feel free to join the
discussion on Github: https://github.com/skerkour/black-hat-rust

9
Chapter 3

Beta & Contact

This version of the book is not the final edition: there can be layout
issues, most of the illustrations will be refined, some things may be in the
wrong order, and content may be added according to the feedback I will
receive.
All the holes in the text are being filled, day after day :)
Also, I fix typos and grammatical errors every 2 weeks, so there can be some
mistakes during the interval.
The final edition of the book is expected for end of Q3 2021.
You can find all the updates in the changelog.
You can contact me by email: [email protected] or matrix: @syl-
vain:kerkour.com

10
Chapter 4

Preface

After high school, my plan for life was to become a private detective, maybe
because I read too much Sherlock Holmes books. In France, the easiest way
to become one, is (was?) to go to law university and then to a specialized
school.
I was not ready.
I quickly realized that studying law was not for me: reality was travestied
to fit whatever narrative politics or professor wanted us to believe. No deep
knowledge was teached here, only numbers, dates, how to look nice and sound
smart. It was deeply frustrating for the young man I was, with an insatiable
curiosity. I wanted to understand how the world works, not human conven-
tions. What is really energy? And, how these machine we call computers
that we are frantically typing on all day long work under the hood?
So I started by installing Linux (no, I won’t enter the GNU/Linux war) on my
Asus EeePC, a small netbook with only 1GB of RAM, because Windows was
too slow, and started to learn to develop C++ programs with Qt, thanks to
online tutorials, coded my own text, my own chat systems. But my curiosity
was not fulfilled.
One day, I inadvertently fell on the book that changed my life: “Hacking:
The Art of Exploitation, 2nd Edition”, by Jon Erickson.
This book not only made me curious about how to make things, but, more
importantly, how to break things. It made me realize that you can’t build

11
reliable things without understanding how to break them, and by extension
where are their weaknesses.
While the book remains great to learn low-level programming and how to ex-
ploit memory safety bugs, today, hacking requires new skills: web exploita-
tion, network and system programming, and, above all, how to code in a
modern programming language.
Welcome to the fascinating world of Rust and offensive security.
While the Rust Book does an excellent job teaching What is Rust, I felt
that a book about Why and How to Rust was missing. That means that
some concepts will not be covered in depth but instead we will see how to
effectively use them in practice.
In this book we will shake the preconceived ideas (Rust is too complex for the
real-world, Rust is not productive…) and see how to architect and create real-
world Rust projects applied to offensive security. We will see how polyvalent
Rust is which enables its users to replace the plethora of programming lan-
guages (Python, Ruby, C, C++…) plaguing the offensive security world with
an unique language (to rule them all) which offers high-level abstractions,
high performance and low-level control when needed.
We will always start with some theory, deep knowledge that pass through
ages, technologies and trends. This knowledge is independent of any pro-
gramming language and will help you to get the right mindset required for
offensive security.
I designed this book for people who either want to understand how attackers
think in order to better defend themselves, or for people who want to enter
the world of offensive security.
The goal of this book is to save you time in your path to action, by distilling
knowledge and presenting it in applied code projects.
It’s important to understand that Black Hat Rust is not meant to be an
big encyclopaedia containing all the knowledge of the world, instead it was
designed as a guide to help you getting started and pave the way to action.
Knowledge is often a prerequisite, but this is action that is shaping the world,
and sometime knowledge is a blocker for action (see analysis paralysis…). As
we will see, some of the most primitive offensive techniques are still the most
effective. Thus some very specific topics, such as how to bypass modern OSes

12
protection mechanisms won’t be covered because there already is extensive
literature on the matter and they have little value in a book about Rust.
That being said, I did my best to list the best resources to further your
learning journey.
It took me approximately 1 year to become efficient in Rust, but it’s only
when I started to write (and rewrite) a lot of code that I made real progress.
Rust is an extremely vast language, but in reality you will (and should) use
only a subset of its features: you don’t need to learn them all ahead of time.
Some, that we will study in this book are fundamentals, but others are not
and may have an adversarial effect on the quality of your code, by making it
harder to read and maintain.
My intention with this book is not only to make you discover the fabulous
world of offensive security, to convince you that Rust is the long-awaited one-
size-fits-all programming language meeting all the needs of offensive security,
but also to save you a lot of time by guiding you to what really matters
when learning Rust and offensive security. But knowledge is not enough.
Knowledge doesn’t move mountains. Actions do.
Thus, the book is only one half of the story. The other half is the accom-
panying code repository: https://github.com/skerkour/black-hat-rust. It’s
impossible to learn without practice, so I invite you to read the
code, modify it and make it yours!
If at any time you feel lost or don’t understand a chunk of Rust code, don’t
hesitate to refer to the Rust Language Cheat Sheet, The Rust Book, and the
Rust Language Reference.

13
Another random document with
no related content on Scribd:
The Project Gutenberg eBook of The shadow
girl
This ebook is for the use of anyone anywhere in the United States
and most other parts of the world at no cost and with almost no
restrictions whatsoever. You may copy it, give it away or re-use it
under the terms of the Project Gutenberg License included with this
ebook or online at www.gutenberg.org. If you are not located in the
United States, you will have to check the laws of the country where
you are located before using this eBook.

Title: The shadow girl

Author: Ray Cummings

Illustrator: Smolenski

Release date: May 8, 2024 [eBook #73572]

Language: English

Original publication: New York, NY: Columbia Publications Inc, 1928

Credits: Greg Weeks, Mary Meehan and the Online Distributed

Proofreading Team at http://www.pgdp.net

*** START OF THE PROJECT GUTENBERG EBOOK THE SHADOW

GIRL ***
 THE SHADOW GIRL

By RAY CUMMINGS

(Author of "Into the Fourth Dimension," "Beyond the Stars,"

etc.)

Here Is Another Classic Science Fiction Novel,

Reprinted by Your Request.

Illustrated by Smolenski.

Out of the misty reaches of

time came a man and girl of
the distant future-New York
to wreak vengeance upon Dr.
Turber, prominent physician
of 1945. But what mystery lay
behind Turber's Indian
assistant, who seemed to
belong to the New Amsterdam
 of Peter Stuyvesant, and how
could Turber menace Great-
New York of 2445? An
absorbing book-length novel
by one of science fiction's
prime favorites.

[Transcriber's Note: This etext was produced from

Science Fiction Quarterly Spring 1942.
Extensive research did not uncover any evidence that
the U.S. copyright on this publication was renewed.]
 CHAPTER I

WHAT THE TELEVISION SHOWED

The extraordinary and mysterious visions of the shadow girl appeared
on the television screen which Alan and I had just erected in his
workshop. It was nearly midnight—a hot sultry evening of late June.
The instrument was a Farodyne polychrome receiver; latest model of
the multiple-cell semi-oscillating type. We had worked all evening
installing it. Alan's sister, Nanette, sat quietly in a corner, modeling a
little statue in green clay. Occasionally she would ask us how we were
getting along.
We were planning to receive the broadcasting from the powerful
Bound Brook station—a program which had been advertised for 11.30
p.m.
The room was dark as we sat at the small instrument table with the
six-foot screen erect against the wall and only the flashing beams
from the whirling color-filters to cast a lurid glow upon us. The screen
hummed as the current went into it. But at once we saw that
something was wrong. The screen lighted unevenly; we could not
locate with any precision the necessary frequency ranges; not one of
the three near-by broadcasting studios which we knew were at that
moment on the air, would come in.
Nanette was disappointed and impatient as I manipulated the dials at
random, and Alan verified the connections. "Is there nothing on it?"
"Presently, Nan. Alan must have grounded it badly—I'm sure we have
everything else—"
I stopped abruptly. My grip tightened on her arm. We all sat tense.
An image was forming on the screen.
Alan said sharply: "Don't touch it, Ed!" I relinquished the dials.
We sat watching, tense, and interested. Then mystified, awed. And
presently upon us all there settled a vague, uneasy sense of fear.
For this, confronting us, was the Unknown.

The screen glowed, not with the normal colors of an interior studio
set, but with what seemed a pale, wan starlight. A blurred image; but
it was slowly clarifying. A dim purple sky, with misty stars.
We sat staring into the depths of the television screen. Depths
unmeasurable; illimitable distance. I recall my first impression when
in the foreground faint gray-blue shadows began forming: was this an
earthly scene? It seemed not. Blurred shadows in the starlight,
crawling mist of shadows, congealing into dim outlines.
We saw presently the wide area of a starlit night. A level landscape of
vegetation. Grassy lawns; trees; a purpling brook, shimmering like a
thread of pale silver in the starlight. The image was sharp now,
distinct, and without suggestion of flicker. Every color rounded and
full. Deep-toned nature, pale and serene in the starlight.
A minute passed. In the center foreground of the vista a white wraith
was taking form. And suddenly—as though I had blinked—there was
a shape which an instant before had not been there. Solid reality. Of
everything in the scene, it was most solid, most real.
A huge, gray-white skeleton tower, its base was set on a lawn where
now I could see great beds of flowers, vivid with colored blossoms.
The brook wound beside it. It was a pentagon tower. Its height might
have been two hundred feet or more, narrowing at the top almost to
a point. Skeleton girders with all the substantiality of steel, yet with a
color more like aluminum.
We were, visually, fairly close to this tower. The image of it stood the
full six feet of our screen. A balcony girded it near the top. A room,
like an observatory, was up there, with tiny ovals of windows.
Another larger room was midway down. I could see the interior—
ladder-steps, and what might have been a shaft with a lifting car.
The tower's base was walled solid. It seemed, as we stared, that like
a camera moving forward, the scene was enlarging—
We found ourselves presently gazing, from a close viewpoint, at the
base of the tower. It was walled, seemingly by masonry, into a room.
There were windows, small and high above the ground. Climbing
vines and trellised flowers hung upon the walls. There was a broad,
front doorway up a stone flight of steps.
And I became aware now of what I had not noticed before: the
gardens surrounding the tower were inclosed with a high wall of
masonry. A segment of it was visible now as a background to the
scene. A wall, looped and turreted at intervals as though this were
some fortress.
The whole lay quiet and calm in the starlight. No sign of human
movement. Nanette said:
"But, Edward, isn't any one in sight? No people—"
And Alan: "Ed, look! There—back there on the wall—"
It seemed on the distant wall that a dark figure was moving. A
guard? A pacing sentry?
And now, other movement. A figure appeared in the tower doorway.
The figure of a girl. She came slowly from within and stood at the
head of the entrance steps. The glow of an interior light outlined her
clearly: a slim, small girl, in a robe faintly sky-blue. Flowing hair, pale
as spun gold with the light shining on it like a halo.
She stood a moment, quietly staring out into the night. We could not
see her face clearly. She stood like a statue, gazing. And then,
quietly, she turned and I caught a glimpse of her face—saw it clearly
for an instant, its features imprinted clearly on my mind. A young girl,
nearly matured; a face, it seemed, very queerly, singularly beautiful—
She moved back into the tower room. There was a sudden blur over
the scene. Like a puff of dissipating vapor, it was gone.
The television screen before us glowed with its uneven illumination.
The color-filters whirled and flashed their merging beams. Everything
was as it had been a few moments before. The broadcasting studios
would not come in. Our apparatus was not working properly. The
frequency ranges were indeterminate. It was grounded badly. Or our
fundamental calibration was in error. Something wrong. What, we
never knew.
But we had seen this vision—flung at us, from somewhere. A vision,
shining clear in every detail of form and color and movement. The
image of things solid and real. Things existing—somewhere.

That was the first of the visions. The second came that same night,
near dawn. We did not dare to touch our instrument. The dials, we
found, had been set by me at random with a resulting wave-length
which could not bring in any of the known broadcasting studios. We
left them so, and did not try to find what might be wrong with the
hook-up. The image had come; it might come again, if we left things
as they were.
We sat, for hours that night, watching the screen. It glowed uneven;
many of its cells were dark; others flickered red and green.
Nanette at last fell asleep beside us. Alan and I talked together softly
so as not to disturb her. We had promised that if anything showed,
we would awaken her. We discussed the possibility. But often we
were silent. The thing already had laid its spell upon us. This vision,
this little glimpse of somewhere. It had come, perhaps, from some
far-distant world? Incredible! But I recall that instinctively I thought
so.
Yet why should I? A tower, and a dim expanse of starlit landscape.
And a girl, humanly beautiful. Surely these were things that could
exist now on our earth. The atmosphere, we knew as a matter of
common everyday science, teems with potential visions and sound.
Alan strove to be more rational. "But, Ed, look here—we've caught
some distant unknown broadcaster."
"But who broadcasts an outdoor scene at night? This is 1945, Alan,
not the year 2000."
He shrugged his wide, thin shoulders. His face was very solemn. He
sat with his long, lean length hunched in his chair, chin cupped in his
palm, the attitude of a youthful, pagan thinker, fronted with a
disturbing problem. But there was a very boyish modernity mingled
with it; a lock of his straight black hair fell on his forehead. He seized
it, twisted it, puzzled, and looked up at me and smiled.
Then Alan said a thing very strange; he said it slowly, musingly, as
though the voicing of it awed him.
"I think it was on Earth. I wonder if it was something that has been,
or that will be—"
It came again, near dawn. The same tower; the same serene, starlit
spread of landscape. The same grim encircling wall, with stalking
dark figures upon it. We did not at first see the girl. The tower
doorway stood open; the room inside glowed with its dim light. A
moment of inactivity; and then it seemed that at this inexplicable
place at which we were gazing—this unnamable time which seemed
the present on our screen—a moment of action had come. A dark
figure on the wall rose up—a small black blob against the background
of stars. The figure of a man. His arm went up in a gesture.
Another figure had come to the tower doorway, a youth, strangely
garbed. We could see him clearly: white-skinned, a young man. He
stood gazing; and he saw the signal from the wall, and answered it.
Behind him, the girl appeared. We could see them speak. An aspect
of haste enveloped all their movements—a surreptitious haste,
furtive, as though this that they were doing was forbidden.
The signal was repeated from the wall. They answered. They turned.
The youth pushed the girl aside. He was stooping at the doorway,
and her eager movements to help seemed to annoy him. He
straightened. He had unfastened the tower door. He and the girl slid
it slowly closed. It seemed very heavy. They pushed at it. The
doorway closed with them inside.
We had awakened Nanette. She sat tense between us, with her long
braids of thick, chestnut hair falling unheeded over her shoulders, her
hands gripping each of us.
"Tell me!"

Alan said: "That door's heavy. They can't close it—yes! They've got it
closed. I fancy they're barring it inside. The thing is all so silent—but
you could imagine the clang of bars. I don't see the guard on the
wall. It's dark over there. There's no one in sight. But, Nan, you can
see that something's going to happen. See it—or feel it. Ed, look!
Why—"
He broke off. Nanette's grip tightened on us.
A change had fallen upon all the scene. It seemed at first that our
instrument was failing. Or that a "hole" had come, and everything
momentarily was fading. But it was not that. The change was
inherent to the scene itself. The tower outlines blurred, dimmed. This
image of its solidarity was dissolving. Real, solid, tangible no longer.
But it did not move; it did not entirely fade. It stood there, a glowing
shimmering wraith of a tower, gray-white, ghostlike. A thing now of
impalpable aspect, incredibly unsubstantial, imponderable, yet visible
in the starlight.
The wall was gone! I realized it suddenly. The wall, and the garden
and the flowers and the stream. All the background, all the
surrounding details gone! The tower, like a ghost, stood ghostly and
alone in a void of shapeless gray mist.
But the stars remained. The purple night, with silver stars. But even
they were of an aspect somehow different. Moving visibly? For an
instant I thought so.
Time passed as we sat there gazing—time marked only by my dim
knowledge that Alan was talking with Nanette. Changes were
sweeping the scene. The gray mist of background under the stars
held a distance unfathomable. A space, inconceivable, empty to my
straining vision.
And then, presently, there were things to see. It seemed that the
infinite had suddenly contracted. The wraith of the tower stood
unchanged. But abruptly I saw that it stood in a deep wooded area,
rearing itself above a tangled forest. A river showed, a mile or so
away, crossing the background in a white line. The stars were gone;
it was night no longer. A day of blue sky, with white-massed clouds.
The sun shone on the distant river.
The tower stood, faded even more in the daylight. I searched the
forest glade around its base. Figures were there! Familiar of aspect; a
group of savages—of this earth? Yes, I could not mistake them:
Indians of North America. Red-skinned, feathered figures, in vivid
ceremonial headdress as though this day they had been dancing in
the forest glade. And saw the strange apparition of this tower. Saw it?
Why, they were seeing it now! Prostrated in a group on the mossy
ground, awed, fear-struck; gazing fearfully upon this thing unknown;
prostrate because this thing unknown must therefore be a god; and
being a god, must be angry and threatening and to be placated.

An instant; and I knew that this which Alan Tremont, Nanette

Tremont, and Edward Williams were vouchsafed was a mere pause. A
tableau. A snatched vision from somewhere—sometime; presented all
in an instant and whirled away.
But the phantom of the tower stood motionless, unchanged. The gray
background whirled, pregnant with things unseeable. No! It was
night. There were the familiar, unchanging stars. I became aware
that the wraith of the tower was solidifying. The gray shadows under
it were turning dark. Gray—then black—then deep green. Trees and
grass. A small white spread of water near at hand.
The tower now was solid, tangible and real of aspect as we had first
seen it. The doorway was still closed. Around it now was the dark
stretch of a cultivated parklike space. All clear and distinct. A reality
here, beyond anything we had seen before.
I gasped. Alan's swift words to Nanette echoed as though from my
own thoughts. This was wholly familiar! This familiar space, pictured
in quiet detail upon the screen. Familiar trees, little paths with
benches along them, grassy lawns, a small, starlit lake. A winding
roadway, with lights at intervals. In the distance, behind the tower, I
could see plainly a large, low building of stone. A city street behind it,
beyond the park. All familiar.
Alan gasped: "Why, it's here! This is barely a mile from us! That's
Central Park! That's the Metropolitan Museum!"
Central Park, New York City. But when? We knew there was no tower
like that in Central Park. Was this the future of Central Park at which
we were staring?

The vision was more than a glimpse now. It held, vividly persisting in
every reality of its smallest detail. The same space of that forest
glade. But now man called it "Central Park." No ignorant savages
were prostrated here now, before this phantom of the tower. No one
here—
And then I saw, in the foreground, a man in a blue uniform standing
on one of the paths of the park. A light shone on him. He stood,
pressed backward against the light-pole; staring at the tower with a
hand upflung against his mouth. Instinctive fear. But not prostrate
upon the ground. He stood tense. And dropped his hand and stood
peering. Incredulous.
"Ed—see that police officer there! He sees the tower!"
The tower door opened. I fancied I saw the figure of the girl step
furtively out and disappear into the shadows of the starlit park. I
could not be sure. It was dark. But in the background, above the
Metropolitan Museum, above the city buildings lining Fifth Avenue, I
could see that the east was glowing with the coming dawn. A mass of
billowing clouds flushed pink.

I saw the girl step furtively out into the starlit park.

The tower doorway was closed again. The tower melted into a
specter, illusive, tenuous, but still there. A gossamer tower. And then,
it was gone. Everything was gone. But as though, in my fancy, or
perhaps merely the persistence of vision, for one brief instant I
seemed to see the park empty of the intruding tower; and the
policeman, standing there incredulous at this that he had seen which
was now vanished.
The television screen was empty of image. Alan was on his feet. "Ed!
Look at the sky out there! That's the same sky!"
The workshop faced to the east. The same star-strewn sky of the
vision was outside our window—the same sky, with the same
modeling of clouds, flushed with the coming day.
Alan voiced my realization. "Why, that's this dawn we've been seeing!
That tower—in the park behind us—that policeman is out there now
—he saw it! That's today! That just happened—now!"

CHAPTER II

THRESHOLD OF A MYSTERY
It was clear to us, or at least in part, what had occurred. The little
fragment of Space occupied by Central Park, was throughout both the
visions, what we had been seeing. The tower was there; the tower
had not moved—in Space. We had first seen it in some far-distant
realm—of Time. And it had moved, not in Space, but in Time. We had
glimpsed the tower almost stopping, frightening those savages who,
in what we call the Past, were roaming this little island of Manhattan.
The same Space. The same inclosing rivers. But no city back then. Or
perhaps, near the southern end, where the converging rivers merged
in broader water, there might just then have been a group of
struggling settlers. Cabins of hewn, notched logs, stockaded against
the marauding redskins of the adjacent forest. A dense forest then,
was north of the trail called "Maiden Lane." Far up there was this
Space which now we call Central Park, with the great New York now
around it, grown in three short centuries from the infant New
Amsterdam.
And the tower, immovable in Space, had come in Time to 1945. Had
paused. Now. This very morning. Had stopped; and frightened a
policeman of 1945, in Central Park. And then had become again a
phantom, and in another instant, wholly invisible.
I recall my surprise at Alan's apparent understanding of this
incredible thing which had come, all unheralded, upon us.
I found suddenly that there were things in the life of Alan which I did
not know. Things he shared with Nanette; but not with me. An
eagerness was in his manner as we discussed this thing. His dark
cheeks were flushed with emotion; his dark eyes had a queer glow of
excitement.
"I think, Ed, that I can understand a good many things of this. Things
father knew, in theory—things he told me—" He checked himself. And
when I questioned, he stopped me.
"Wait, Ed. It's confusing. It seems—tremendous." He stumbled over
the word, but repeated it. "Tremendous." And then he added: "And
perhaps—dastardly."
What could he mean by that? Nanette said: "But, Alan—that girl—
there was a girl, came here to New York this morning—"
The girl! The shadow girl, from out of the shadows! She, at least,
was something tangible now. We had seen her in Central Park this
morning. The television screen now was vacant. It was destined
never again to show us anything, but that we did not know. We had
seen a girl arriving? Then, if so, she must be here—in Central Park,
now.
Alan said: "I wonder if we should report it. That girl probably will be
found." He had been into one of the other rooms of the small
apartment a few moments before. He drew me there now. "Ed, I
want to show you something significant. Perhaps significant—I don't
know, yet."
Nanette followed after us. The bedroom faced south. We were high in
a towering apartment building, just east of Fifth Avenue.
Over the lower roofs of the city I could see far to the south. In the
waning starlight down there a single searchlight beam was standing
up into the sky.
"Where is it?" I demanded. "The Battery? A ship in the harbor? Or
Staten Island?"
Somewhere down there, a white shaft of light standing motionless. It
was fading in the growing daylight.
"On Staten Island," said Alan. "It's a small searchlight on the roof of
the Turber Hospital. It often stands like that. Haven't you ever
noticed it?"
I supposed I had. But never thought of it. Why should I?
Alan added musingly: "It's queer—because I was wondering if it
would chance to be there now, and there it is."
"But, Alan, see here—you're making a mystery of this. Heaven knows
it's mysterious enough of itself, without your adding more."

He smiled. I saw suddenly a grimness as the smile faded and he set

his wide, thin lips. There were things which he was beginning to
piece together. Things, involving us so soon into such a maelstrom of
events! But now, Alan only said:
"This Dr. Turber—Wolf Turber—have you ever heard of him?"
"No," I said. "What has he to do with this? Whatever it is, you've
guarded it very carefully from me, Alan."
There must have been a touch of bitterness in my tone. He laughed.
"Nonsense! I haven't known anything worth discussing."
Nanette touched me: "It was something father told us just before he
died. Just a theory of his—a suspicion."
"So inexplicable," said Alan. "But he was so earnest, that morning he
died. Telling us what might be things of scientific fact, but probably
would never be disclosed—to us or any one. Yet now it may be—
these things this morning seem to fit in. Ed, it's no secret—not from
you."
"Then," I said, "who is Dr. Turber? What is he to you?"
"Nothing. He was, in 1925, a young medical student. Then, for a
short while, he worked for father. He now owns the Turber Hospital—
a private institution, a sort of sanatorium. He is, in his way, a genius.
A specialist in nervous disorders. And father said he was—or would
have been, had he stuck at it—an eminent physicist. But he did not.
He left father—he stole, father thought, a large sum of father's
money. I don't know the details. They're not important. Nothing was
proved. He became—well, you might call him father's enemy.
Certainly they disliked each other. I've met him casually several times.
A scoundrelly sort of fellow, by his look. And that—of what I actually
know—is all."
We were back in the workshop. The television screen still glowed, but
it was empty of image. Nanette said gently: "Tell him, Alan, about Dr.
Turber, and me."
It gave me a start. Alan said: "He seems to have fallen head over
heels in love with Nanette. He had always liked her—"
"I was always afraid of him," she put in.
"And when Nanette grew up, even though then he was father's
enemy, Turber came to him—wanted to marry Nanette—"
I could well imagine it. Nanette was tall, slim, with long chestnut hair
incongruous in this day of short-haired girls. To me she was very
beautiful indeed.
Alan went on: "I won't go into details. His persistent attentions were
unwelcome. Father told him so, and Nanette told him."
"I was always afraid of him," she repeated.

Alan smiled wryly. "I threw him out once—a snaky sort of fellow. We
want none of him—do we, sister?"
"No," she said. "Tell Edward about Dr. Turber's life—father's theory."
"It wouldn't mean much to you, Ed. There were things—so father
thought—of mystery about this Turber. Things inexplicable. His
curious, unexplained absences from the hospital. Things about him
which father sensed. And the searchlight, that for no apparent reason
for years now has been occasionally flashing from the hospital roof. It
marks Turber's absence, I know that much."
"And Turber's assistant," said Nanette. "That Indian—whatever he is
—at the hospital."
"Yes. He, too. Father pieced it together into a very strange, half-
formed theory. I have always thought it must have been born of
father's dislike for the fellow. And father told it to me the morning of
his death. That, too, I felt, must have colored it. Father's mind, there
at the last, roaming a little—not quite clear. But this, Ed—this
morning—these visions of ours—we saw them, you know, we can't
deny that. They seem vaguely, to fit. Oh, there's no use theorizing—
not yet. That girl we saw—"
Upon the girl it hinged, of course. The vision was gone. And at best it
was only a vision. But the girl might be real—here in 1945.
We did not report what we had seen to the police. Perhaps we had
fancied that a girl came out of a phantom tower in Central Park this
morning. And, if we had seen it on the television, even so, it might
not actually have happened.
Had there actually been a policeman, there in the park, who had
seen it? And was there existing, here in New York today, this girl of
the shadows?
We waited, and the thing turned tangible indeed! Became a reality,
for presently we learned that it had touched others than ourselves.
The early afternoon papers carried a small item. Some of them put it
on the front page. But it was only a joke—a little thing to read, to
laugh at, and forget. There had been in actuality, a policeman at
dawn in Central Park; and he had been less reticent, more incautious
than ourselves. He had told what he saw. And the newspapers wrote
it:

Ghost of Eiffel Tower Invades Central Park

Policeman Fights Phantom

Something to laugh at, and forget. A chuckle, donated to a busy city

by earnest Officer Macfarland who undoubtedly was already sorry
that he had not kept his mouth shut.
And the girl?
The later afternoon papers carried another item. Who would connect
the two? Who, indeed! For this other item was still smaller,
unobtrusive, not even amusing. Nor novel—and therefore, worthy of
nothing but a passing glance:
Unknown girl found at gate of Central Park. Unable to
speak intelligibly. Victim of amnesia. Taken to Bellevue.
Later transferred to Turber Hospital, Staten Island.
Who would think anything of that? But we three knew that we stood
upon the threshold of a mystery, with its shadowy portals swinging
wide to lure us in.

CHAPTER III
THE GIRL PRISONER

We left Nanette at home and Alan and I started for the Turber
Hospital about three o'clock that same afternoon.
Was this the girl of our visions, now the "victim of amnesia" at Dr.
Turber's Sanatorium? Or was it merely some other girl whose
memory had gone, and whose prosaic parents soon would come to
claim her? Things like that frequently happened. We determined to
find out. Both of us were sure we would recognize her.
From the ferryhouse on Staten Island we took a taxi, a few miles into
the interior. It was an intensely hot, oppressive afternoon—the sun
was slanting in the west when we reached our destination.
I found the Turber Hospital occupying a fairly open stretch of country,
about a mile from the nearest town. It stood on a rise of ground—a
huge quadrangle of building, completely inclosing an inner yard. It
was four stories high, of brick and ornamental stone; balconies were
outside its upper windows, with occasional patients sitting in deck
chairs with lattice shades barring the glare of sunlight.
There were broad shaded grounds about the building—the whole
encompassing, I imagined, some twenty or thirty acres. Trees and
paths and beds of flowers. A heavy, ten-foot ornamental iron fence
with a barbed wire top inclosed it all. A fence which might have been
to keep out the public, but which gave also the impression of keeping
in the inmates. The place looked, indeed, very much like the average
asylum. There was an aura of wealth about it; but, unlike most such
places, also a look of newness.
"Turber built it in the last eight years," said Alan. "He's doing very
well—rich patients of the neurotic, almost insane but not quite,
variety."
There were some of them about the grounds now. Off at one end I
could see tennis courts with games in progress.
"Spent a lot of money," I commented.
"Yes—they say he's very rich."
Bordering the grounds was a scattered, somewhat squalid
neighborhood of foreigners. We had crossed a trolley line and
ascended a hill arriving at the main gateway of the institution. I
glanced back through the rear window of our taxi. We were on a
commanding eminence; I could see across the rolling country, over
several smoky towns to New York Harbor; the great pile of buildings
on lower Manhattan was just visible in the distant haze.
The gatekeeper passed us at Alan's request to see Dr. Turber. Our
taxi swung up a winding roadway to the porte-cochere at the side of
the building.
"Will he see us?" I demanded.
"If he's here, I imagine he will."
"But you're not, even outwardly, friends?"
He shrugged. "We speak pleasantly enough when we have occasion
to meet. So long as he lets Nanette alone."
We were ushered into the cool quiet of a reception room. The white-
clad nurse said that doubtless Dr. Turber would see us presently—he
was busy at the moment. She left us.
It was a fairly large room of comfortable wicker chairs; Oriental rugs
on a hardwood, polished floor; a large wicker center table strewn
with the latest magazines. A cool, dim room; there were broad
French windows, with shades partly drawn and additionally shrouded
with heavy velvet portieres across the window alcove.
We had seated ourselves. Alan drew his chair nearer to mine. He
spoke softly, swiftly, with an eye upon the archway that gave onto
the main lower corridor down which the nurse had gone.
"I was thinking, Ed—when Turber comes—we've got to have some
excuse for seeing the girl."
"Yes, but what?"
"Tell him—I'll tell him you're a newspaper man. Some of them have
been here already, no doubt. We won't go into it—you won't have to
say much."
I was, in actuality, a pilot in the mail service from Bennett Field down
the coast to Miami. I was off now, these three summer months. But
posing as a newspaper man was out of my line.
"I don't know," I said dubiously. "I have no credentials. If he asks me
—"
"I'll do most of the talking, Ed." He jumped up suddenly, went to
glance into the corridor, and came back. "Come here, I want to show
you something."
He drew me to the windows. We pushed the portieres aside, and
raised one of the shades. We were some ten feet above the level of
the paved inner courtyard. Alan murmured: "Just look, Ed—queer
construction of this place! I've often wondered, and so did father."
Queer construction indeed! The quadrangular building completely
inclosed this inner yard. At the basement level it was all normal
enough. Windows and doors opening from what seemed engine
rooms; the kitchen; the laundry. And at this first story it was normal
also. These windows through which we were looking; and other
windows and occasional balconies in each of the wings. But above
this first story there were three others and then the flat roof above
them. And in these three upper floors so far as I could see there was
not a window! Nothing but the sheer, blank stone walls!
"What would you make of that, Ed? Crazy architecture—they said
that when the place was built. There are no courtyard rooms at all in
the upstairs floors—nearly half the building goes to waste. Turber
designed it—"
"But what did he say?"
"Nothing much, I fancy. It was his own business. Perhaps, merely
that he could afford the luxury of all outside rooms for his patients.
And look at that inner building—"

The courtyard was perhaps two hundred feet long, by half as wide.
In its center was an oblong brick building, a hundred feet by sixty
possibly—and not quite as high as the roof of the main structure.
From the angle at which we were gazing, I could see the full front
face of this smaller building, and part of one of its ends. It had not a
window! Nor a door, except one, very small, at the ground in the
center of the front!
"Turber's laboratory," said Alan. "At least, that's what it's supposed to
be. That one door—nothing else. It's always locked. Nobody has even
been in there but Turber, and his Indian assistant. Father once talked
with the builders of this place, Ed. That laboratory is nothing but two
small rooms at the ground level here in front. All the rest is just four
solid brick walls inclosing an inner empty space! What's it for?
Nobody knows. But people talk. You can't stop them. Turber's
employees here. And most of all, his patients—not quite sane. They
talk—of ghosts—things mysteriously going on inside those walls—"
People—not quite sane—talking of things unknowable. But I was
wholly sane; and as I stood there, gazing at the shadows of twilight
gathering in this inner courtyard; the blank upper walls of the large
building turning dark with night; the smaller one, standing blank and
silent in the courtyard—the whole place seemed suddenly ominous,
sinister!

A step sounded in the room behind us. I started violently; I had not
realized how taut were my nerves. We dropped the portieres hastily,
and left the window. Turber?
But it was not he. A young man stood before us. He was dressed in
flannels and a shirt open at the throat. He carried a tennis racket.
"Well," said Alan. "How are you, Charlie? Been playing tennis? You
remember me, don't you?"
A good-looking young fellow. He said: "Do I? You were here once
before, weren't you? I saw you in here with Dr. Turber."
"Yes," said Alan. "Let's sit down, Ed. How are you, Charlie?"
We sat down. Charlie stood before us. "I've been playing tennis. Is
the doc coming here to see you?" His face clouded. "You're all right,
aren't you? My mother said—" He was addressing me. "My mother
said—but look here, don't pay any attention to your mother if she
says you're sick. Don't you do it! I did it, and my mother said I'll put
you in here and make you well. So look what happened to me—I'm in
here."
I met Alan's glance. Alan said: "Well, that's fine, Charlie. And you're
better, aren't you?"
"Yes." He hesitated; then he added: "I'm better, and I'd like to help
you get better. I was thinking that, last time I saw you. I like you—
very much."
"Do you, Charlie? That's nice of you."
"Yes. You're a friend of mine—'Friends sturdy and true' I was thinking
—that's us."
He turned suddenly away. He took a step toward the window, and
came back. His face had wholly changed; a look of cunning was on it;
his voice low, quivering, dramatic.
"You were looking out there when I came in. Strange things go on
out there—but you can't see them in the daytime!"
"Can't you?" said Alan. "I was looking—"
"I've seen them—at night. I've got a way to see them any time I
want to. From the roof. If you get put in here—I'll show you—maybe.
Because we're friends."

It galvanized Alan into action. He jumped to his feet and gripped

Charlie.
"I'd like you to show me."
"Yes, I can do it. There's a girl came this morning. I saw her—"
"A girl?"
"Beautiful girl. She was beautiful—I saw her. They took her upstairs. I
know where."
Alan gestured to me. "Watch out if anybody comes! Charlie, tell me!"
I moved nearer the corridor entrance. Alan and Charlie stood by the
window. I could hear them.
"She's sick, but her mother didn't bring her. Men brought her—in a
taxi like I saw you come in."
"Charlie, if I should come here—"
"I've got a key to the roof. You're not allowed up there. Nobody's
ever been up there but me. I'm too smart for them—'Keys to open
Bluebeard's room'—you can't open anything without a key. Keys to
open Bluebeard's—"
"Charlie, stop that!"
"Well, I have. It's dark. Nothing ever happens in the light. You can
see it from the roof, because you're higher up and you can look down
inside."
"Inside what?"
"His laboratory. That's what they call it. 'Four walls to hide what
devils do'—that's Shakespeare. I studied it, when I was in school. But
mother said I was sick—"
"Wait, Charlie. That girl—"
"She's sick, I guess. We're all sick. But she was frightened, too. I'm
not frightened. I passed them in the hall. She looked at me—I saw
she was frightened. I said then to myself I guess I can help that girl.
I'm smart—I've got keys."
If Turber should come! But the corridor was empty.
"You know which room is the girl's, Charlie?"
"Yes."
"You've got a key to it?"
"Key? I've got a key to Bluebeard's closet—"
Alan shook him. "The girl's room—where they've got her now."
"Key to Bluebeard's room—don't get excited—I'm not excited." He
was trembling. "When you come to live here—"
"Charlie, listen! I want to help that girl—get her out of here. She isn't
sick."
"I can get out of here—but my mother told me not to. I've got a key
to the little gate in the fence behind the tennis court. I've had it a
long time. You know how to make a key? You take wax and get an
impression—I had a locksmith make the key when I was home at
Christmas. Mother thought it was my trunk key—but it wasn't. I
thought I might use it to slip out and go home some night. Only
mother would be angry. And I had Bluebeard's key made at the same
time—that's the key to the roof, where you can see things—"
From the door I caught a glimpse of a man approaching along the
corridor.
"Alan! Here he comes!"
Alan said vehemently: "Charlie, listen! Get this right! Tonight, about
ten o'clock! Can you have your keys and come to the tennis court
gate?"
"Yes! Tonight—"
"Can you get there, alone? Tell nobody? Let nobody see you!"
"Yes. At night—dark deeds, alone." He heard Dr. Turber's step. He
added swiftly: "I'll be there—ten o'clock tonight! I can hide you in my
room. At eleven, they're all asleep—we'll go to the roof—I call it
Bluebeard's—"
"Not a word to anybody, Charlie! For the girl's sake!"
"Yes! And because we're friends—"
Alan pushed him away; and said, conversationally: "So you had a
good game, Charlie? That's fine—but you'd better go wash up for
supper."
"All right, I will. Mother said never be late for supper."
We all turned as Dr. Turber entered the room.

I saw Dr. Wolf Turber as a man of about forty, obviously of

extraordinary personality. There are many men in this world who
have a power, for good or evil, which marks them apart from their
fellows. A radiation—an aura—a something in their unconscious
bearing; a confidence, a flash of the eye, all unmistakable. Dr. Turber
was such a one. Marked for big things—good or evil.
He was, to me at least, at once physically repellent of aspect. A very
heavy, powerful frame, with wide shoulders, thick and solid; a deep
chest; long powerful arms. Had he stood erect, he might have been
fully six feet tall. But he was hunched. Not exactly a hunchback;
rather, a permanent stoop which had rounded his shoulders almost to
a deformity.
His head was massive, set low on a wide, short neck. Close-cropped
black hair, turning gray at the temples. A solid, wide-jawed face,
smooth-shaved, with dark eyes gazing through a pair of
incongruously dapper rimless glasses, from which a wide black ribbon
depended.
He stood before us; stooped, but with the strength of a gorilla
seeming to lie hidden in his squat frame, masked by the dapperness
of his clothes. Pointed patent leather shoes; gray trousers; a dark
gray jacket with a white waist-coat, to which the black eyeglass
ribbon was fastened. He stood with a hand toying with the ribbon.
"He annoyed you, Tremont? Charlie's a good boy. A little off mentally
—like most of them here."
Charlie had been summarily dismissed. Turber added: "You do not
bring the charming little Nanette. Where is she? I would far rather
see her than you, Tremont."
Alan, from his six-foot height, gazed down at Turber. He ignored the
reference to Nanette, and said:
"There was a girl found in Central Park this morning. Amnesia case,
the papers say. Transferred here from Bellevue. My friend Williams
here does some newspaper writing—he'd like to see her."
Turber's face remained calmly polite. His gaze went to me. It made
my heart leap—his quiet, keen scrutiny, as though without effort he
might read my thoughts.