Download the full version of the textbook now at textbookfull.

com

Hands-On Penetration Testing on Windows:

Unleash Kali Linux, PowerShell, and Windows
debugging tools for security testing and
analysis 1st Edition Phil Bramwell
https://textbookfull.com/product/hands-on-
penetration-testing-on-windows-unleash-kali-linux-
powershell-and-windows-debugging-tools-for-
security-testing-and-analysis-1st-edition-phil-
bramwell/

Explore and download more textbook at https://textbookfull.com

 Recommended digital products (PDF, EPUB, MOBI) that
you can download immediately if you are interested.

Kali Linux 2018 Windows Penetration Testing Conduct

network testing surveillance and pen testing on MS Windows
using Kali Linux 2018 2nd Edition Halton
https://textbookfull.com/product/kali-linux-2018-windows-penetration-
testing-conduct-network-testing-surveillance-and-pen-testing-on-ms-
windows-using-kali-linux-2018-2nd-edition-halton/
textbookfull.com

Penetration Testing with Kali Linux Offensive Security

https://textbookfull.com/product/penetration-testing-with-kali-linux-
offensive-security/

textbookfull.com

Penetration Testing with Kali Linux OSCP Offensive

Security

https://textbookfull.com/product/penetration-testing-with-kali-linux-
oscp-offensive-security/

textbookfull.com

Guide to Wireless Communications Olenewa

https://textbookfull.com/product/guide-to-wireless-communications-
olenewa/

textbookfull.com
Hydrogen Peroxide Metabolism in Health and Disease 1st
Edition Hampton

https://textbookfull.com/product/hydrogen-peroxide-metabolism-in-
health-and-disease-1st-edition-hampton/

textbookfull.com

Philosophy of Engineering East and West 1st Edition Carl

Mitcham

https://textbookfull.com/product/philosophy-of-engineering-east-and-
west-1st-edition-carl-mitcham/

textbookfull.com

Nonconformity, Dissent, Opposition, and Resistance in

Germany, 1933-1990: The Freedom to Conform 2020th Edition
Sabrina P. Ramet
https://textbookfull.com/product/nonconformity-dissent-opposition-and-
resistance-in-germany-1933-1990-the-freedom-to-conform-2020th-edition-
sabrina-p-ramet/
textbookfull.com

Adventures in Mathematical Reasoning First Edition Sherman

Stein

https://textbookfull.com/product/adventures-in-mathematical-reasoning-
first-edition-sherman-stein/

textbookfull.com

Buying green A handbook on green public procurement 3rd

Edition Publications Office Of The European Union

https://textbookfull.com/product/buying-green-a-handbook-on-green-
public-procurement-3rd-edition-publications-office-of-the-european-
union/
textbookfull.com
From Dairy Farmer To Forex Trader 111th Edition Andrew
Mitchem

https://textbookfull.com/product/from-dairy-farmer-to-forex-
trader-111th-edition-andrew-mitchem/

textbookfull.com
||||||||||||||||||||

||||||||||||||||||||
||||||||||||||||||||

Hands-On Penetration Testing on Windows

Unleash Kali Linux, PowerShell, and Windows debugging tools for security testing and
analysis

Phil Bramwell

||||||||||||||||||||
||||||||||||||||||||

BIRMINGHAM - MUMBAI

||||||||||||||||||||
||||||||||||||||||||

||||||||||||||||||||
||||||||||||||||||||

Hands-On Penetration Testing on

Windows
Copyright © 2018 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or
by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented.
However, the information contained in this book is sold without warranty, either express or implied. Neither the author,
nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been
caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned
in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this
information.

Commissioning Editor: Vijin Boricha

Acquisition Editor: Shrilekha Inani
Content Development Editor: Sharon Raj
Technical Editor: Komal Karne
Copy Editor: Safis Editing
Project Coordinator: Virginia Dias
Proofreader: Safis Editing
Indexer: Priyanka Dhadke
Graphics: Tom Scaria
Production Coordinator: Shraddha Falebhai

First published: July 2018

Production reference: 1270718

Published by Packt Publishing Ltd.

Livery Place
35 Livery Street
Birmingham
B3 2PB, UK.

ISBN 978-1-78829-566-6
www.packtpub.com

||||||||||||||||||||
||||||||||||||||||||

I would like to dedicate this book to my wife, Sonia, without whose unwavering support, patience, and commitment, I
wouldn't be who I am today; to Mom, Dad, Rich, and Alex, for their endless inspiration, support, and willingness to
read my nonsense; to Lenna and Sasha, whose constant support, both emotional and practical, allowed me to muster
the energy and will to accomplish this and so much more; to my son and daughter, whose smiles and goofiness give me
a reason to keep going every single day.

||||||||||||||||||||
||||||||||||||||||||

mapt.io

Mapt is an online digital library that gives you full access to over 5,000 books and
videos, as well as industry leading tools to help you plan your personal development
and advance your career. For more information, please visit our website.

||||||||||||||||||||
||||||||||||||||||||

Why subscribe?
Spend less time learning and more time coding with practical eBooks and Videos
from over 4,000 industry professionals

Improve your learning with Skill Plans built especially for you

Get a free eBook or video every month

Mapt is fully searchable

Copy and paste, print, and bookmark content

||||||||||||||||||||
||||||||||||||||||||

PacktPub.com
Did you know that Packt offers eBook versions of every book published, with PDF and
ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a
print book customer, you are entitled to a discount on the eBook copy. Get in touch with
us at service@packtpub.com for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a
range of free newsletters, and receive exclusive discounts and offers on Packt books
and eBooks.

||||||||||||||||||||
||||||||||||||||||||

Contributors

||||||||||||||||||||
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
||||||||||||||||||||

About the author

Phil Bramwell acquired the Certified Ethical Hacker and Certified Expert Penetration
Tester certifications at the age of 21. His professional experience includes Common
Criteria design reviews and testing, network security consulting, penetration testing, and
PCI-DSS compliance auditing for banks, universities, and governments. He later
acquired the CISSP and Metasploit Pro Certified Specialist credentials. Today, he is a
cybersecurity and cryptocurrency consultant and works as a cybersecurity analyst
specializing in malware detection and analysis.
A big thank you to everyone at Packt. I initially told Shrilekha "no way," but she motivated me to believe in myself.
Sharon was available day and night to guide me and keep my eyes on the prize. I also want to thank my friends and
mentors from Kalamazoo to Atascadero to Answers to Plante Moran: thank you for keeping me going.

||||||||||||||||||||
||||||||||||||||||||

About the reviewer

Abhijit Mohanta works as a malware researcher for Juniper Threat Labs. He worked
as a malware researcher for Cyphort, MacAfee, and Symantec. He has expertise in
reverse engineering. He has experience working with antivirus and sandbox
technologies. He is author of the book Preventing Ransomware, Understand everything
about digital extortion and its prevention. He has written a number of blogs on malware
research. He has filed a couple of patents related to malware detection.

||||||||||||||||||||
||||||||||||||||||||

Packt is searching for authors like you

If you're interested in becoming an author for Packt, please visit authors.packtpub.com and
apply today. We have worked with thousands of developers and tech professionals, just
like you, to help them share their insight with the global tech community. You can make a
general application, apply for a specific hot topic that we are recruiting an author for, or
submit your own idea.

||||||||||||||||||||
||||||||||||||||||||

Table of Contents
Title Page
Copyright and Credits
Hands-On Penetration Testing on Windows
Dedication
Packt Upsell
Why subscribe?
PacktPub.com
Contributors
About the author
About the reviewer
Packt is searching for authors like you
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Download the color images
Conventions used
Get in touch
Reviews
Disclaimer

||||||||||||||||||||
||||||||||||||||||||

1. Bypassing Network Access Control

Technical requirements
Bypassing MAC filtering – considerations for the physical assessor
Configuring a Kali wireless access point to bypass MAC filtering
Design weaknesses – exploiting weak authentication mechanisms
Capturing captive portal authentication conversations in the clear
Layer-2 attacks against the network
Bypassing validation checks
Confirming the Organizationally Unique Identifier
Passive Operating system Fingerprinter
Spoofing the HTTP User-Agent
Breaking out of jail – masquerading the stack
Following the rules spoils the fun – suppressing normal TCP replies
Fabricating the handshake with Scapy and Python
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

2. Sniffing and Spoofing

Technical requirements
Advanced Wireshark – going beyond simple captures
Passive wireless analysis
Targeting WLANs with the Aircrack-ng suite
WLAN analysis with Wireshark
Active network analysis with Wireshark
Advanced Ettercap – the man-in-the-middle Swiss Army Knife
Bridged sniffing and the malicious access point
Ettercap filters – fine-tuning your analysis
Killing connections with Ettercap filters
Getting better – spoofing with BetterCAP
ICMP redirection with BetterCAP
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

3. Windows Passwords on the Network

Technical requirements
Understanding Windows passwords
A crash course on hash algorithms
Password hashing methods in Windows
If it ends with 1404EE, then it's easy for me – understanding LM hash
flaws
Authenticating over the network–a different game altogether
Capturing Windows passwords on the network
A real-world pen test scenario – the chatty printer
Configuring our SMB listener
Authentication capture
Hash capture with LLMNR/NetBIOS NS spoofing
Let it rip – cracking Windows hashes
The two philosophies of password cracking
John the Ripper cracking with a wordlist
John the Ripper cracking with masking
Reviewing your progress with the show flag
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

4. Advanced Network Attacks

Technical requirements
Binary injection with BetterCAP proxy modules
The Ruby file injection proxy module – replace_file.rb
Creating the payload and connect-back listener with Metasploit
HTTP downgrading attacks with sslstrip
Removing the need for a certificate – HTTP downgrading
Understanding HSTS bypassing with DNS spoofing
HTTP downgrade attacks with BetterCAP ARP/DNS spoofing
The evil upgrade – attacking software update mechanisms
Exploring ISR Evilgrade
Configuring the payload and upgrade module
Spoofing ARP/DNS and injecting the payload
IPv6 for hackers
IPv6 addressing basics
Local IPv6 reconnaissance and the Neighbor Discovery Protocol
IPv6 man-in-the-middle – attacking your neighbors
Living in an IPv4 world – creating a local 4-to-6 proxy for your tools
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

5. Cryptography and the Penetration Tester

Technical requirements
Flipping the bit – integrity attacks against CBC algorithms
Block ciphers and modes of operation
Introducing block chaining
Setting up your bit-flipping lab
Manipulating the IV to generate predictable results
Flipping to root – privilege escalation via CBC bit-flipping
Sneaking your data in – hash length extension attacks
Setting up your hash attack lab
Understanding SHA-1's running state and compression function
Data injection with the hash length extension attack
Busting the padding oracle with PadBuster
Interrogating the padding oracle
Decrypting a CBC block with PadBuster
Behind the scenes of the oracle padding attack
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

6. Advanced Exploitation with Metasploit

Technical requirements
How to get it right the first time – generating payloads
Installing Wine32 and Shellter
Payload generation goes solo – working with msfvenom
Creating nested payloads
Helter Skelter evading antivirus with Shellter
Modules – the bread and butter of Metasploit
Building a simple Metasploit auxiliary module
Efficiency and attack organization with Armitage
Getting familiar with your Armitage environment
Enumeration with Armitage
Exploitation made ridiculously simple with Armitage
A word about Armitage and the pen tester mentality
Social engineering attacks with Metasploit payloads
Creating a Trojan with Shellter
Preparing a malicious USB drive for Trojan delivery
Summary
Questions
Further reading

||||||||||||||||||||
Visit https://textbookfull.com
now to explore a rich
collection of eBooks, textbook
and enjoy exciting offers!
||||||||||||||||||||

7. Stack and Heap Memory Management

Technical requirements
An introduction to debugging
Understanding the stack
Understanding registers
Assembly language basics
Disassemblers, debuggers, and decompilers – oh my!
Getting cozy with the Linux command-line debugger – GDB
Stack smack – introducing buffer overflows
Examining the stack and registers during execution
Lilliputian concerns – understanding endianness 
Introducing shellcoding
Hunting bytes that break shellcode
Generating shellcode with msfvenom
Grab your mittens, we're going a NOP sledding
Summary
Questions
Further Reading

||||||||||||||||||||
||||||||||||||||||||

8. Windows Kernel Security

Technical requirements
Kernel fundamentals – understanding how kernel attacks work
Kernel attack vectors
The kernel's role as time cop
It's just a program
Pointing out the problem – pointer issues
Dereferencing pointers in C and assembly
Understanding NULL pointer dereferencing
The Win32k kernel-mode driver
Passing an error code as a pointer to xxxSendMessage()
Metasploit – exploring a Windows kernel exploit module
Practical kernel attacks with Kali
An introduction to privilege escalation
Escalating to SYSTEM on Windows 7 with Metasploit
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

9. Weaponizing Python
Technical requirements
Incorporating Python into your work
Why Python?
Getting cozy with Python in your Kali environment
Introducing Vim with Python syntax awareness
Python network analysis
Python modules for networking
Building a Python client
Building a Python server
Building a Python reverse shell script
Antimalware evasion in Python
Creating Windows executables of your Python scripts
Preparing your raw payload
Writing your payload retrieval and delivery in Python
Python and Scapy – a classy pair
Revisiting ARP poisoning with Python and Scapy
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

10. Windows Shellcoding

Technical requirements
Taking out the guesswork – heap spraying
Memory allocation – stack versus heap
Shellcode whac-a-mole – heap spraying fundamentals
Shellcode generation for the Java vulnerability
Creating the malicious website to exploit Java
Debugging Internet Explorer with WinDbg
Examining memory after spraying the heap
Fine-tuning your attack and getting a shell
Understanding Metasploit shellcode delivery
Encoder theory and techniques – what encoding is and isn't
Windows binary disassembly within Kali
Injection with Backdoor Factory
Code injection fundamentals – fine-tuning with BDF
Trojan engineering with BDF and IDA
Summary
Questions
Further reading

||||||||||||||||||||
||||||||||||||||||||

11. Bypassing Protections with ROP

Technical requirements
DEP and ASLR – the intentional and the unavoidable
Understanding DEP
Understanding ASLR
Testing DEP protection with WinDbg
Demonstrating ASLR on Kali Linux with C
Introducing return-oriented programming
Borrowing chunks and returning to libc – turning the code against itself
The basic unit of ROP – gadgets
Getting cozy with our tools – MSFrop and ROPgadget
Metasploit Framework's ROP tool – MSFrop
Your sophisticated ROP lab – ROPgadget
Creating our vulnerable C program without disabling protections
No PIE for you – compiling your vulnerable executable without ASLR ha
rdening
Generating a ROP chain
Getting hands-on with the return-to-PLT attack
Extracting gadget information for building your payload
Finding the .bss address
Finding  a pop pop ret structure
Finding addresses for system@plt and strcpy@plt functions
Finding target characters in memory with ROPgadget and Python
Go, go, gadget ROP chain – bringing it together for the exploit
Finding the offset to return with gdb
Writing the Python exploit
Summary
Questions
Further reading

||||||||||||||||||||
Random documents with unrelated
content Scribd suggests to you:
 Again and again Peter swept the horizon ahead with[57] his
binoculars. Nothing—not even a blur of smoke—obscured the clearly
defined line which cut sea and sky. But far away out yonder wireless
messages were being sent by the scouting destroyers, announcing
with ever increasing certainty that the enemy was still coming south.

Two bells of the afternoon watch sounded off. Peter could hardly
realize that fifty minutes had elapsed since he ascended to his eyrie.
Surely it was about time, with the rival fleets approaching at an
aggregate rate of from forty to fifty-five knots, that something was
seen of the enemy?

A few seconds later and a triple hoist of bunting crept past the
fore-top. Fifty answering pennants were almost immediately hoisted
on fifty different ships, large and small. Then a burst of cheering—a
huge volume of sound—came from the invisible crews of the
battleships, to be taken up by their comrades in the cruisers and on
until the furthermost destroyer within signalling distance joined in
the roar of appreciation.

It was the Admiral's battle signal:

"Strike hard, strike straight for England."

"There they are, by smoke!" exclaimed one of Peter's companions

in the fore-top.

Peter raised his glasses. With uncanny suddenness, the hitherto

unbroken skyline was dotted with the masts, funnels, and
superstructures of a host of vessels, their hulls still below the
horizon. Approaching each other at the rate of an express train, the
rival fleets were now within visual distance or, roughly, fifteen miles.
[58]

The destroyers that had been on ahead of the battleships, their

mission for the time being accomplished, had turned tail and were
taking station astern. The chance of getting to work with the deadly
torpedo was not yet. Until gun-fire had demoralized the half-tried
gunners of the Rioguayan battleships, it was a purposeless, futile
business to dispatch thinly-plated destroyers against armoured ships
bristling with quick-firers.

Suddenly Peter caught a glimpse of a couple of flying-boats

hovering well in advance of the British ships. Apparently they were
engaged upon reconnoitring duties—for they made no attempt to
take up a position favourable for bomb-dropping.

As a matter for precaution, Peter turned out one of the anti-aircraft

apparatus with its crew, but it was neither the time nor the occasion
to make use of the rays. Had the hostile aircraft been bombing
machines intent upon scoring a hit, the case would have been
different; but they were spotting machines, up to record the results
of salvoes and to acquaint the Rioguayan admiral of the disposition
of the British ships. The light cruisers would deal with them.

It was the Cadogan that brought her rays into action. Both flying-
boats dropped like shot partridges, recovering in time to enable
them to volplane to the water. Here they drifted helplessly until a
destroyer ranged alongside each in succession, removed the crews,
who did not offer the slightest resistance, and sent the abandoned
aircraft to the bottom.[59]

"Neat work that," thought Peter. "It proves that friend Ramon Diaz
hasn't found an antidote for the rays. Apparently he's satisfied with
stealing Uncle Brian's secret."

Meanwhile the four battleships had deployed into single line

abreast, each with the object of getting its four 15-inch guns of A
and B turrets to bear upon the enemy.

So engrossed was Peter with the little episode of the flying-boats,

that the distant rumble of heavy gunfire—sounding like a subdued
thudding upon a bass drum—failed to attract his attention.
 A few seconds later a veritable cauldron of foam, a dozen separate
pillars of spray, announced to him and to a favoured few who could
see what was going on outside the ship, that the action had
commenced by the enemy opening fire. As a gratifying corollary was
the knowledge that the salvo had fallen short.

"Sixteen thousand five hundred," chaunted the range-finding

lieutenant, the moment the battleship had emerged from the slowly
dispersing wall of spray.

"Train fifteen red," sang out another voice in a lower key.

The two for'ard turrets swung a few degrees to the left. The long
lean guns rose slowly, as if roused from slumber.

Again the distant rumble. This time Peter could see the massive
hostile projectiles approaching. The air seemed stiff with them,...
and they were coming his way. Instinctively he ducked behind the
thin steel[60] plating of the fore-top—a protection hardly more
serviceable than brown paper. The beastly shells seemed in no great
hurry.... He could see the bright copper rifling bands on the dark
grey bodies of the projectiles.

"Train twenty-five green," came the clear level tones again.

The Rebound had starboarded helm, and the enemy, instead of

being on her port, were now well on her starboard bow.

With an infernal screech, the salvo trundled past the flagship's

foremast, falling within a radius of fifty yards, a good three cables'
lengths astern.

"Straddled, by Jove!" ejaculated a midshipman with Peter in the

fore-top. "Why the——?"

His question was interrupted by a deafening crash that shook the

tripod mast like a bamboo in a hurricane. The steel platform seemed
to jump bodily. A whiff of acrid-smelling cordite flicked over the edge
of the steel breastwork.

Peter gave a sidelong glance at the midshipman. It was the

youngster who, but a short while before, was gloating over the
prospect of being in action. The boy's face was pale underneath the
tan. He laughed—it was a forced laugh without any ring of sincerity
about it. His heart was doubtless in his boots, but he was making a
gallant effort to get it back into its right place.

Retrieving his binoculars, Corbold brought them to bear upon the

distant target. The terrific concussion[61] was the simultaneous
discharge of the four 15-inch guns of A and B turrets. Already the
salvo was on its way towards a target unseen by the fifty odd men
cooped up within the two turrets. Eight miles away those shells, by
the latest workings of the science of gunnery, were calculated to fall
—and they did.

Through his glasses, Peter watched the receding flight of the huge
missiles, each weighing more than a ton. The impact came. At first
there was little to indicate to the observer's eye that they had done
their work—just a few dark splashes on the light grey hull of a
Rioguayan battleship—no more. But the next instant the scene had
changed considerably. The projectiles had burst, not on impact, but
after they had eaten into the vitals of the enemy ship. Lurid flashes
leapt from her superstructure and from different parts of her lofty
hull. One of her funnels sagged, hung irresolute, and then crashed
across her port battery. Then flame-tinged smoke poured through a
dozen unauthorized outlets. Reeling like a drunken man, the
Rioguayan battleship hauled out of line and disappeared behind the
ship next astern.

By this time the firing had become general. The four British
battleships were letting rip as fast as the loading-trays could deliver
shells and ammunition into the rapacious breeches of the enormous
weapons. The din was terrific, while the vibration was so intense
that the fore-top was shaking and rattling like a high-pressure
engine on a faulty bed.

"Goodness only knows what we're here for,"[62] thought Peter,

wiping the cordite dust from his eyes and shaking the beads of salt
spray from the peak of his cap. "Can't see a blessed thing."

He continued to peer out automatically. There was little to be seen,

save when an occasional lifting of the pall of spray and smoke
enabled him to see the flashes of the guns of the Royal Oak and her
consorts. His senses were benumbed by the continuous crashes. He
was no longer afraid. A sort of stolid indifference seemed to take
possession of the fragments of thought left in his brain. The whole
business seemed a ghastly, bewildering nightmare.

A terrific crash, outvoicing every other noise in the pandemonium,

shook the fore-top like a rattle. The occupants, hurled violently,
subsided in a confused struggling heap upon the steel floor. For
some moments they remained prostrate, making no effort to sort
themselves out.

Peter opened his eyes, to close them quickly again. Someone's heel
was beating a tattoo within an inch or so of his nose.

He wriggled clear and sat up. One of the bluejackets, wedged in an

angle of the walls, was mopping the claret that welled from his nose.
The two officers and the midshipman were sorting themselves out,
looking too dazed to understand how they got there and what they
were doing. The second bluejacket was muttering to himself as he
fumbled in his jumper for some article that he had prized and lost.

"Anyone hit?" bawled Peter.[63]

His words were inaudible, but no one showed any signs of serious
injury. The fore-top was shaking badly—not only through the
continuous concussion, but as if it were no longer firmly secured to
the head of the tripod mast. The small oval aperture that opened
into the principal leg of the tripod, and formed an alternative means
of gaining the deck, was open. Wisps of smoke issued from it.

A man with a bandaged head appeared, squeezing with an obvious

effort through the door. Peter recognized him as a petty-officer
belonging to the range-finding party.

"Fair kippered that way, sir," he shouted. "A perishin' eel couldn't
wriggle through. No, mast ain't carried away quite. 'S got a bulge in
'er. Lootenant, 'e told me to report verbally that our range-finder's
knocked out, an' all controls smashed up."

Having explained his presence, the P.O. spat on his hands, hitched
up his trousers, and lowered himself over the edge of the fore-top.

Peter, leaning over, watched him grip the rungs on the outside of
the tripod and commence his eighty-odd feet descent. Then
something else attracted the young officer's attention.

All was not well with A and B turrets. They had ceased firing. The
smoke had cleared considerably, but from the riven roof of A turret a
column of white flame was leaping almost as high as the platform on
which Peter stood. He was unpleasantly aware of the[64] heat. The
updraught was like that of a blast-furnace. Someone touched him on
the shoulder. Turning, he saw Ambrose, one of the officers with him
on the top.

"Looks like the Queen Mary stunt," said Ambrose grimly. "We'll be
blown sky high in half a shake."

Peter replied that that possibility was by no means remote. That

white flame came from burning cordite. Once the fire got to the
magazine the Rebound would be blown to smithereens.

"We shan't have to go as far as some of those poor blighters,"

continued Ambrose, with a wry smile. He came of a stock of fighting
men, many of whom had met death with a jest on their lips.
 It was indeed a desperate situation. The occupants of the fore-top
were craning their necks over the sizzling flame. Projectiles were still
hurtling through the air. Although the for'ard guns of the flagship
had ceased fire, Q and X turrets were still hard at it, trained abeam
to starboard. Smoke was pouring from the funnels and enveloping
the fore-top. Either the wind had changed, or else the ship had
swung round sixteen points and was retracing her course. At least,
Peter imagined so, until a partial clearing of the smoke showed that
the Rebound was going astern, but still towards the enemy line.
Battered and bruised for'ard, and with her bows well down, she was
still holding her place in the line.

Even as he watched, Peter fancied that the column of white flame

was diminishing. Men, looking no[65] larger than flies, were swarming
round the turret with hoses directing powerful jets of water into the
raging inferno. Steam mingled with the flame. The pillar of fire
wavered, died down, flared up again, and finally went out like a
guttered candle.

Losing all account of time, Peter "carried on"—doing absolutely

nothing. His range of vision was limited, owing to dense clouds of
smoke, steam, and spray. The turret sighters and men at the
rangefinders on the "Argo" towers, could see much better than he,
since the atmosphere was less obscured closer to the waterline and
the opposing fleets had drawn to within torpedo range. As far as
Corbold was concerned, existence seemed to be composed of a
continual roar and vibration, punctuated by deeper concussions that
indicated direct hits from Rioguayan guns. How the battle was
progressing, he knew not. That it was being fiercely contested, he
had no doubt, nor had he that ultimate victory would be with the
ships flying the glorious White Ensign. He was beginning to feel
horribly sick, for in addition to the distracting vibration, a whiff of
poison gas-shell had wafted over the fore-top.

A flash of orange-coloured flame rent the billowing clouds of acrid-

smelling smoke. The light seemed to spring from a source within a
few feet of the tripod mast-head. Actually a 5.9-inch had glanced
obliquely from the hood of B turret and had burst outside the
massive steel walls of the conning-tower.

Again Peter was hurled against the side of the fore-[66] top. How
long he remained there, he had not the faintest recollection. At
length he raised his head. His companions were strangely quiet,
except the midshipman, who was vainly attempting to stifle his
groans. There were jagged rents in the floor and in the sides of the
fore-top; there were also holes punched as neatly as if done by a
pneumatic drill. There were pools, too, of dark sticky liquid....

Peter struggled to his feet, somewhat surprised that he was able to

do so. As far as he knew, he had not been hit. He turned his
attention to his companions. Ambrose was lying on his side, his face
pillowed on his left arm. There was the same grim smile on his face.
He looked to be sleeping peacefully, but it was the sleep that knows
no wakening on this earth. The other lieutenant and the two
bluejackets were simply shattered lumps of clay. Only Peter and the
midshipman were left alive out of the seven, since there was no
trace of the third able seaman.

The snottie looked Peter in the face with eyes that resembled those
of a sheep on the slaughter-block.

"I've stopped one," he exclaimed feebly. "'Fraid it's the last fielding
I'll ever do."

His left leg was completely severed just below the knee, yet Peter
noticed the stump was only bleeding very slightly. The shock had
evidently contracted the torn arteries, but there was every possibility
of a rush of life-blood before very long.

Fumbling with unsteady fingers at his first-aid outfit, Peter

contrived to rig up a rough-and-ready[67] tourniquet. His next step
was to get the wounded lad down to the dressing-station. As far as
he, personally, was concerned, there was not the slightest reason
why he should remain in the wreck of the fore-top. The question
was, how was he to get the midshipman down?

Even had the passage down and within the centre leg of the tripod
been available (which it was not), the small diameter of the shaft
would not have permitted the descent of one man with another
clinging to his back. To lower the snottie was also out of the
question, since the signal halliard nearest the mast had been shot
away and no other rope was available. The only likely way was to
descend on the outside of the mast by means of the rungs provided
for that purpose.

"Can you hang on, do you think?" inquired Peter anxiously.

"I'll have a good shot at it, anyway," was the reply. As a matter of
precaution, the young lieutenant knotted his scarf round the
midshipman's body and his own. Then, heavily burdened, he let
himself down through the jagged gap in the floor of the fore-top
that had once been a trap-door.

Rung by rung he made his way, never once looking down and
religiously adhering to the old sea maxim: "Never let go with more
than one hand or foot at a time."

The eighty-odd feet descent seemed interminable. Momentarily,

Peter's burden grew heavier. The lad's grip, at first so strong as to
threaten to choke him, was[68] becoming feebler. His own leg-
muscles were giving indications of cramp, or else, perhaps, he had
received an injury of which at the time he was unaware. Presently
his left foot, groping for the next rung, failed to find a temporary
resting-place. For the first time in the descent, Peter looked down.
Where a series of rungs should have been, was a gaping void,
encompassed by a saw-like edge of riven steel. In ordinary
circumstances, he could have dropped without risk, since he was
only about eight feet above the boat-deck. But where the leg of the
tripod passed through the boat- and flying-decks was an abyss, out
of which acrid fumes were wafting. A shell that had penetrated the
side had burst on the upper-deck and had blown upwards,
completely isolating the stricken leg of the tripod from the other two
decks by a gap at least fifteen feet across.

"If I cast you adrift, can you hang on for a couple of minutes?"
asked Peter, shouting at the top of his voice above the discordant
din.

There was no response.

The midshipman had lost consciousness.[69]

CHAPTER XXVIII
In Action—'Tween Decks

On parting with Peter Corbold, Cavendish made his way for'ard,

through the battery and out by the armoured door of the screen.
Throughout his progress, he could not help remarking upon the
enthusiasm of the crews of the quick-firers as they cleared away and
triced up the mess-tables and closed up round their guns.

They were the pick of Britain's manhood, for the most part men
under twenty-five, tall, deep-chested, clean-shaven fellows, looking
in their singlets and trousers like zealously-trained athletes.

The battery was in semi-darkness, save for the yellow gleam of the
candles in the battle-lanterns. Oil lamps, for obvious reasons, were
not lighted, while the electric lamps were disconnected from their
holders and stowed away. The lesson of Jutland had shown how
dangerous an electric-light globe can be. The concussion of gunfire
alone will shatter it into a thousand jagged little fragments with
disastrous results as far as the bare feet of the guns' crews are
concerned.

Fire-hoses, sending their jets of water from their[70] unions, lay

along the deck like healthy serpents, ready to trip the unwary.
"Present use" ammunition was stacked in the rear of the guns, ready
to feed their rapacious maws when the order to open fire with the
secondary armament was received. Above the chatter of men's
voices came the rattle of the ammunition cages and the steady purr
of the engines far below the waterline.

"Close up round your guns, my lads," the bronzed and bearded

gunner kept on shouting, "close up and give the greasy swine socks
when the time comes."

Arriving at his action station, Cavendish climbed the short iron

ladder and passed through the narrow doorway in the rear of the
turret. Blades, the officer in charge, gave him a delighted grin.

"No blessed mist this time, Weeds," he observed. "It'll be an

almighty hammering... what's that, Petty-officer?"

"Crew numbered off, sir; all present and correct, sir."

"Very good—test loading-gear. Then stand by."

Blades turned away to watch operations. Cavendish, his work not

yet begun, stood behind the turret-trainer under the sighting-hood.

"Anything in sight yet?" inquired Cavendish.

"Nothing yet, sir," was the reply, as the P.O. stepped aside to allow
his officer to peep out.
 Cavendish placed his eyes to the rubber-rimmed periscope. As he
did so, he heard the order given, "load all cages!" The show was
about to open.[71]

He could see nothing but an expanse of sunlit sea and sky. Out
there lay the hostile fleet, but still below the horizon, although no
doubt visible from the fore-top and fire-control platform.

"We'll be firing by direction, sir," supplemented the turret-trainer.

Even as he looked, Cavendish's range of vision was obscured by a

white wall of spray. The enemy's opening salvo had fallen short.

"Train fifteen red!"

The turret turned smoothly—so smoothly that Cavendish was

hardly conscious of the pivotal movement. The breeches of both
weapons sank gently as the muzzles reared themselves almost to
extreme elevation.

The lieutenant moved away from the sighting-hood and watched

the massive steel monsters for the recoil that would announce that
the master-hand well outside the turret had completed the circuit
that would send the mighty projectiles on their pre-ordained flight.

There was a breathless silence, broken only by subdued noises

down in the working-chamber and the crash of a salvo that had
passed handsomely over the ship.

"Train twenty-five green!"

Back rolled the turret until the still silent weapons were trained on
the bearing ordered.

A suspense of a few long-drawn seconds, then with a roar the guns

of A and B turrets spoke simultaneously and with no uncertain voice.
[72]
 The period of inaction was over.

Recoiling to the full extent of their hydraulic buffers, the huge

weapons jumped forward again into loading-position. Men sprang to
the breech-blocks; a strong whiff of burnt cordite wafted back into
the confined space of the turret. The huge 15-inch projectiles were
rammed home by the mechanically operated rammer; followed the
bag containing the propelling charge; and again the breech-blocks
closed with a deep metallic clang.

A brief pause, and again the pair of guns recoiled.

Apart from watching the turret crew "carrying on" as rapidly and as
smoothly as a well-ordered machine, Cavendish began to feel
decidedly bored. There was a most terrific clamour going on without
—probably the "five-point-fives" of the starboard battery were
getting to work. In that case, he decided, there might be something
to be seen.

He touched the turret-trainer on the shoulder. The man stepped

aside. Cavendish applied his eyes to the periscope. He could see
nothing. Even if the enemy ships had closed to within a few
thousand yards, they were still invisible, for the front glass of the
periscope was blackened and smudged with smoke, oil, and water.
The continuous concussion was positively painful. The noise and
rattle of a dozen pneumatic hammers in a double bottom was
nothing to it.

Cavendish had lost all idea of time. He glanced at his wristlet

watch. It told him that he had been in[73] the turret only five
minutes. A second look showed that the watch had stopped.

Just then, Blades, the lieutenant of the turret, caught sight of him.

"Hello, old thing!" he exclaimed. "You haven't been sent for yet?"
 "No," shouted Cavendish in reply. "And don't want to be sent for.
Shows everything's going on all right. I'll——"

A jet of greasy oil forced through a broken gland struck Cavendish

in the face and interrupted his words.

"Faugh!" he ejaculated. "Your beastly turret again."

"Sorry, old man!" replied Blades, apologizing for the misbehaviour

of his beloved "box o' tricks". "'Tany rate, if that's all you get, you're
lucky."

One of the turret guns' crew appeared and put his face close to
Cavendish's ear.

"Message through from Captain, sir," he reported. "'E wants you to

go aft and report, seein' as 'ow the ship's been badly 'it."

The two officers exchanged glances.

"Good old Weeds!" exclaimed Blades. "'England expects', and all

that sort of thing, you know."

"Yes, I know," agreed Cavendish, with a wry grimace.

Turning up his coat-collar, although it was not until afterwards that

he recognized the futility of the action, Cavendish scrambled out of
the turret. Wriggling[74] like an eel and feeling very forlorn and
unhappy out in the open, he slid over and gained the port
superstructure ladder. Cordite-laden clouds were sweeping past him
as the guns of B turret fired simultaneously. He could feel the blast
and the back-draught much too close to be pleasant. A murderer
making for one of the Jewish cities of refuge couldn't have sprinted
in quicker time or in greater funk than he did in his mad rush for the
door of the superstructure—only to find that aperture barred and
bolted.
 Hardly knowing how he did it, Cavendish found himself clambering
over the remains of the cutter, his progress hastened by a shell that
burst against the horizontal leg of the tripod mast, fortunately
without carrying it away or bowling the lieutenant over by the
shower of splinters.

Right along the deserted mess deck Cavendish hurried. Here and
there were fairly round holes where projectiles had passed through
the thin steel plating. Soon he located the serious damage; a 14-inch
shell had completely penetrated the armour at the water-line and
had exploded between decks.

The shell had played havoc. The compartment was so full of smoke
that it was impossible to enter without a respirator. A fire had broken
out, the corticine and shattered teak planking allowing it to get a
good hold until the water, pouring in through the shell-hole every
time the ship rolled to starboard, put most of it out. Right beneath
was the after dressing station, already occupied by twenty or
thirty[75] cases, most of them suffering from burns. Through a hole
in the deck, water was liberally flowing in upon the medical staff and
their patients.

Shouting for a fire-party, Cavendish soon had the rest of the flames
under control, the badly damaged hoses notwithstanding. Then
came the task of plugging the shell-hole in the armour plate. This
was accomplished by means of a number of rolled hammocks shored
up with timber.

The lieutenant, finding that nothing more could be done, dismissed

the party and went below the armoured deck to reassure the
Surgeon Commander.

"How goes it?" demanded the Medical Officer.

"Dashed if I do know," replied Cavendish. "I was in too tearing a

hurry. Couldn't see anything if I wanted to. But I know we're keeping
our end up."
 "And the enemy?"

"No use asking me," persisted the lieutenant. "I've heard nothing,
seen nothing. You've had a busy time, Doc."

The Surgeon Commander gave a quick glance round the crowded

dressing-station.

"Twenty-eight," he replied, "and every man-jack a perfect brick.

Not a whine amongst the crowd. And some of them are—well—
thank God for morphia!"

He picked up an instrument from the sterilizing bowl and turned

away. Already he had performed five amputations by the light of a
few candle lamps, with the place shaking like a house during an
earth- [76] quake, and stuffy with fumes from the shell that had burst
on the deck immediately overhead.

At the head of the ladder, Cavendish was intercepted by one of the

carpenter's crew.

"I've been sent to fetch you, sir," explained the man. "There's a
nasty mess up for'ard."

The lieutenant hurried along the mess-deck, negotiating various

obstacles and passing groups of men "standing easy". Many inquiries
they made of how things were going, but Cavendish, beyond
reassuring them, could give no definite news.

When at length he arrived upon the scene of the damage for'ard,

he looked grave.

A 15-inch shell had penetrated the unarmoured end, twenty feet

abaft the stem, blowing jagged rents in the plating and in places
starting whole sheets of metal from their frames. The cable stowed
in the manger had been flung about like string. A fire had been
started, but had been already got under control by the fire-party,
who, under the orders of the chief carpenter, were endeavouring to
plug the rents with canvas and bedding.

It was a useless task. The sea was pouring in like a mill race,
washing men and gear away like corks. The sunlight was streaming
through the gaps into the smoke-laden compartment, giving
Cavendish the impression that he was in a train about to emerge
from a tunnel—only that the din was a hundred times greater.

The only thing to be done was to abandon this[77] compartment.

 [Illustration: "WEEDS! BEAR A HAND!" Page 275]

The water-tight doors and bulkhead were shored up with kit-bags,

hammocks, and balks of timber. Cavendish stood by and watched as
the bow compartment filled. The barricade bulged slightly. Streams
of water oozed through the started rivet holes in the bulkhead. The
steelwork groaned—but it stood the strain. So far so good.

Telling off a hand to keep watch over the bulkhead and dismissing
the rest of the party, Cavendish made his way to the trunk of the
conning-tower, whence by means of a ladder and a manhole he
could gain the conning-tower itself.

Here he found the Captain and reported the damage. "All right;
carry on," was the response.

The Rebound had stopped and was already losing way. She was so
deep down by the bows that it would have been imprudent to
continue to steam ahead. A destroyer, in obedience to a signal, was
alongside for the purpose of transferring the admiral and his staff to
another ship.

From one of the officers in the conning-tower, Cavendish learnt

something definite. The enemy were in flight. Three, possibly four, of
their capital ships had been sunk. The rest had been badly mauled.
The Numancia, which under a different name was at one time a
crack ship of the Brazilian navy, and had recently been acquired by
Rioguay, had been so severely punished that she had surrendered to
the British destroyer Audax. The Audax herself was in a sinking
condition, so her commander promptly turned over[78] his crew to
the prize, secured the survivors of the Rioguayan under hatches, and
compelled the republican engine-room ratings to carry on. The
Numancia was thus able to render considerable service to her new
masters by finishing off a pair of hostile cruisers that, although
disabled, were still capable of discharging their torpedoes.

"And you're deucedly lucky, old top," continued Cavendish's

informant.

"I don't see how," rejoined the lieutenant.

"Then have a look at B turret," suggested the other. "That was your
action station, I believe."

By this time the admiral's flag had been transferred.

The Captain and the rest of the conning-tower staff were making
their way to the after citadel, for the ship was gathering sternway.
Although unable to keep her place in the line, she could still render
good service with the guns of Q and X turrets.

As far as the Rebound was concerned, there was a decided lull in

the action. In turning through sixteen points, she had of necessity
lost a considerable distance and was a good five miles astern of the
Royal Oak and the three other battleships.

Cavendish went to the front of the badly damaged fire-bridge in

order to see the damage to B turret. Clouds of smoke, pouring from
both funnels and from a huge rent in the base of the foremost
funnel, were sweeping for'ard. It was impossible to see with any
distinctness.

Descending to the boat deck, the lieutenant noticed[79] that the

inclined leg of the tripod mast was wreathed in smoke, and that the
boat deck all around it had been torn away. A party of marines and
stokers were playing hoses on the smouldering débris, and in
answer to Cavendish's inquiries, replied that the fire was almost out.

"Weeds! Bear a hand, there's a good sort!"

 Hearing his nickname shouted, Cavendish glanced aloft. Clinging to
the lowermost intact rungs of the badly damaged tripod was Peter
Corbold, with something looking like a scarecrow lashed across his
shoulders.

"Right-o!" bawled Cavendish. "Hang on a bit. I'll get you down."

"I can hang on for two minutes," rejoined Peter.

Realizing that there was no time to be lost, Cavendish turned out a

party of bluejackets. A block was not to be had, but a length of two-
inch rope was soon forthcoming. A hurried test proved it to be
serviceable. One of the men swarmed up the jagged leg of the
tripod like a cat, regardless of lacerated fingers and ankles. In a few
seconds the rope with a "bowline on the bight" at one end was rove
through one of the rungs above Peter's head. His burden was
transferred to the bowline and lowered away until the unconscious
midshipman was level with the shell-torn boat-deck and dangling in
the centre of the jagged hole.

By the aid of a short length of rope, the snottie was drawn within
arm's reach of three or four bluejackets,[80] and before Peter gained
the deck the lad he had rescued was well on his way to the dressing
station.

"Hit, Peter?" inquired Cavendish laconically, as he noticed the

smoke begrimed, blood-stained face of his chum.

"Don't think so," replied Peter, stretching his arms to relieve the
cramped muscles. "How are things going?"

Except for the funnel smoke and wisps of steam and smoke from a
dozen different sources, the air for some miles around was
comparatively clear. In the distance could be discerned the four
battleships still firing heavily. The hostile fleet, or, rather, those still
flying the Rioguayan ensign, were invisible in the haze of gunfire.
 Away on the port hand was a British light cruiser with a heavy list.
Flames and smoke, were pouring between her funnels. A destroyer
was standing by to rescue her crew. Astern were a couple of enemy
destroyers, badly damaged, but displaying the White Ensign over the
Republican colours. Close to them were the bows of another
destroyer sticking up vertically to a height of about thirty feet above
the surface. Everywhere were large patches of black oil and débris of
all descriptions.

"We've whacked 'em," replied Cavendish. "Come along, old thing, if

you're fit. I've got to look at B turret."

The ship was now making about twelve knots, going astern the
whole time. Most of the crew were[81] on deck to get a well-earned
breather and to watch the progress of the running fight.

Cavendish stood stock still when he caught sight of what had been
his action station. B turret was completely out of action. Only a few
minutes after he had been sent aft, a 15-inch projectile had landed
squarely on the face of the turret below the sighting-hood.
Penetrating the 11-inch armour, it had burst with devastating effect
in the confined space of the turret. Several massive steel plates had
been dislodged from the roof of the hood; the two 15-inch guns had
been displaced from their mountings, with their muzzles resting on
the deck. Those of the crew who had escaped from the direct
explosion of the shell were killed by the ignition of a couple of
cordite charges. The resulting fire was the one Corbold had seen
from the top. Fortunately the men filling the trays at the foot of the
ammunition trunk realized the danger of the down-blast and, acting
on their own initiative, flooded the magazine.

When Peter and Cavendish arrived upon the scene, smoke was still
issuing from the roof of the turret. Fire parties were at work with
hoses, pouring volumes of water into the shell-wrecked charnel-
house that had not long since been tenanted by thirty officers and
men.
 For the present nothing more could be done.

Suddenly Peter gave a glance to the west'ard. The sun was on the
point of setting.

"By Jove," he exclaimed, "I thought it was nearly[82] time for seven-
bell tea, and it's close on four bells in the first dog. Let's get some
grub."

"Right-o!" agreed Cavendish soberly, for he was still thinking of his

late comrades of B turret. "Let's. We mayn't have another chance,
'specially if we go into action during the night."[83]

CHAPTER XXIX
After the Battle

A buzz of voices greeted the ears of the two chums as they "blew
into" the ward-room. The first lieutenant, the engineer-commander,
three or four watch-keeping officers, the padre, and the surgeon had
foregathered to partake of a "stand-up" meal. The commander,
having swallowed a cup of cocoa, was making for the bridge, with
the remains of a half-consumed bully-beef sandwich in his bandaged
hand.

"Hardly knew we were in action," declared the engineer-

commander. "Once or twice, perhaps, when we were hit by shells;
otherwise, we might have been on steam trials for all we knew."

"Gave the blighters a bellyful, anyway," observed one of the junior

lieutenants. "My gun was out of action five minutes after the battery
opened fire. Not half a mess. Looked out and saw an enemy
battleship blow up. Seemed slow work, but it really didn't last fifteen
seconds."

"I saw her, too," added another. "The wreck of her standard
compass landed on our quarter-deck.[84] Hanged if some marines
didn't clear out of the battery and start picking up the bits for
souvenirs. Hello, Weeds, back to your little grey home again, I see.
What were your impressions, old lad?"

"Noise," replied Cavendish. "Had enough to last me a lifetime, so I

came down here for quietude and find none."

Which went to show that Cavendish, usually a jovial soul, was

decidedly "mouldy". Now that this phase of the action was over, his
nerves were very much on edge.

As for Peter Corbold, he was as yet hardly able to realize his

surroundings. He could hear people talking, but their voices seemed
far away. His head was buzzing like a top. His throat was dry and
parched. He was hungry. Yet, somehow, now that food and drink
were available, he made no immediate effort to satisfy the inner
man.

The ward-room had come off lightly. There was one hole in the
side, apparently made by a 6-inch. The missile had glanced off the
fore transverse bulkhead and had brought up against the fore-and-
aft bulkhead separating the ward-room from the half-deck lobby. In
its course the shell, which luckily did not explode, had completely
gutted the piano, although the front of the already sorely-tried
instrument showed no signs of internal disarrangement.

There were no settees or chairs. Down the centre of the room was
a trestle table hastily rigged up by the mess-room servants. On it
were enamel cups and[85] plates, open tins of bully beef, bread and
butter, and two iron kettles filled with hot cocoa, The ward-room
crockery was no more.
 "You'll have to buck up, Soldier, and replenish our mess traps,"
remarked the doctor to the captain of the marines, who held the
honorary yet responsible position of Mess President.

"We'll have to wait till we go home for that, M.O.," replied the
marine officer, "unless we loot the official residence of the President
of Rioguay."

"When are we going home, anyway?" inquired the Chaplain. "We

can't barge about here, drawing thirty-eight feet of water for'ard,
and there are no docks available out here."

"If you don't know, Padre, who does?" rejoined the First Lieutenant
grimly. In other circumstances, the jest would have raised a general
laugh, but no one even smiled.

The Senior Medical Officer pushed aside his plate. As he moved,

the smell of iodine followed him.

"Must see the Owner," he announced. "He wants a list of

casualties."

"What is the butcher's bill, M.O.?" asked the Engineer-commander.

The surgeon shrugged his shoulders. Of all the ship's company he

was perhaps the best able to estimate war at its true value. Without
providing the excitement of combat his work brought clearly before
him just those nerve-racking details which the fighting[86] man
himself is too busy to realize until such time as they cannot influence
his conduct.

"Heavy," he replied. "Very heavy. Some people are fond of telling

you that war is one remedy for over-population. It is: only it starts at
the wrong end. The weakling and the man who has enjoyed life go
scot-free, or nearly always, while youth and strength pay the toll."
 "S'pose it's the same with t'other side," observed "Jimmy the One",
after the M.O. had gone. "That pot-bellied bald-headed president of
theirs tells 'em to go and get killed, and they do. Dash the
Washington Conference, say I. If we'd a navy—an incontestably
strong navy—President Jaime Samuda wouldn't have dared to
declare war. We're winning, but look at the price we've paid—our
ship alone."

"Sooner we get back to a Two or even a Three Power standard, the

better for everybody," added the Chaplain. "'Defence, not defiance',
you know. A big navy is synonymous with security; a small navy—
well—a big casualty list, and I've seen enough of a dressing-station
to-day to make me plump for an Umpteen Power Standard."

"And what's your opinion, Padre, about disarmament?" inquired the

Engineer-commander. "Only the other day, when we were lying at
Bermuda—after ye with the butter, Weeds, old son—at Bermuda,
you remarked—hello! there's action stations!"

The shrill notes of a bugle had the effect of clearing the ward-room
almost as quickly as if a hostile shell[87] had made a sudden and
unexpected entry. In double quick time the already battle-worn
officers raced off to their respective posts.

"It's 'hands to night defence'," corrected Cavendish, as the two

chums gained the quarter-deck. "Well, thank goodness we're in the
same watch-bill. It's going to be a sticky night."

Their station was on the fore-bridge, which, since the ship was
going astern, corresponded to the after-bridge. Here, Cavendish was
in charge of the searchlight party and the light quick-firers. Corbold's
task was to take charge of the hands told off to work the anti-
aircraft ray apparatus, since it was quite possible that the Rioguayan
air fleet would attempt to make good the disaster to their surface
ships.
 But nothing of the kind happened. No hostile flying-boat was
reported. Neither were the enemy submarines in evidence, although
several of the crippled British light cruisers and destroyers offered an
easy target in the bright starlight of the tropical night.

Away to the north-west flashes of gunfire were still visible, while

now and again far-flung bursts of flame indicated the business-like
activities of the British torpedo craft in the same quarter.

Nevertheless, it was not all watch on board the Rebound. Work was
the principal order of the night. Certain repairs had to be put in hand
forthwith; others less urgent had to wait, while much of the damage
was beyond the resources of the ship and would have to be deferred
until she was in dockyard hands. But[88] before dawn, the débris had
been dumped overboard. A turret, which had been jammed at the
same time that B turret was knocked out, was again in fighting trim.
The rents in the two funnels were patched, thereby freeing the ship
from the danger and inconvenience of spark-laden smoke sweeping
for'ard along the boat deck. The damaged tripod mast was
strengthened by means of steel rods and booms "woolded" with
fathoms of flexible steel wire and light chain. Electric-light circuits
and pipes belonging to the Downton pump system had been
repaired and the wireless aerials renewed.

The Rebound was no longer cut off from the rest of the world and
the fleet in particular. It was now possible to receive a fairly accurate
account of the battle. The remnants of the Rioguayan fleet had
gained Venezuelan territorial waters, and were creeping within the
three-mile limit towards their base. Every vessel flying the
Republican colours was carefully watched over by the British light
cruisers and destroyers, ready, should the enemy vessels
incautiously go outside the limit of neutral waters, to "slap in a
mouldy" (torpedo) or to open fire. Throughout the night, the course
of the demoralized Rioguayan ships was carefully checked by scores
of British sextants, while gunlayers stood by with fingers itching to
press firing trigger, and leading torpedo-men lingered longingly over
the "bar" by which the deadly Whitehead was dispatched on its
errand of death and destruction. The Rioguayan battleships had put
up a good fight[89] at the commencement of the action. Confident in
their superior numbers, they fired salvo after salvo with
commendable accuracy; but when the British shells began to find
their target with a skill and rapidity that was an eye-opener to the
Republican crews, the moral of the Rioguayans simply vanished.

Of their capital ships, two were blown up by gunfire, three were

torpedoed and sunk, two were captured, although of these one was
in a sinking state and had to be abandoned by her prize crew during
the night.

Their light cruisers had come off lightly, for directly the Rioguayan
battleships turned sixteen points and fell back, they played for
safety, steaming off at full speed to the nor'ard. Nevertheless, three
had been overhauled and sunk by five light cruisers of the D class.

Amongst the hostile destroyers the losses were also slight, for they,
too, were broken reeds. One flotilla did, however, attempt a night
attack upon the severely-punished British battleships, but was driven
off by the supporting light cruisers and destroyers with a loss of six
out of the fourteen craft originally comprising the flotilla. It was
already perfectly clear that President Samuda's plans for the future
greatness of Rioguaya—and incidentally of himself—stood a
particularly poor chance of ever being realized if they depended for
success on naval supremacy.

On the British side the losses were heavy, but confined chiefly, as
far as ships were concerned, to the light cruisers and destroyers,
which pushed home the[90] attack with a dash and daring worthy of
the traditions of the senior service. All the battleships had survived
the action and were still capable of dealing hard knocks. The
Rebound had been seriously damaged; the Royal Oak had received
three big shells just above the waterline, but, although listing to
starboard, was able to maintain her station. The Retrench had
practically all the guns in her battery on the port side put out of
action, but her turret guns were undamaged. The Repulse, on which
the dockyard staff at Bermuda had set right her defects in time for
her to take her place in the line, had both her bows and stern blown
away as far as the 4-inch armoured belt. Her mainmast had gone by
the board. Altogether, she looked a wreck, but the damage hardly
impaired her fighting qualities, the ship being quite tight below the
water-line and her armament intact.

The losses in personnel were great: 1015 killed and 622 wounded.
Of these, the casualties on board the Rebound accounted for 125
killed and 82 wounded. The excess of fatalities was a clear indication
of the destructive power of guns. Wherever a heavy shell burst it
killed everyone within the battery or turret. The wounded were
mostly hit by fragments of flying metal at a considerable distance
from the point of impact, or were severely burnt by fires that broke
out simultaneously in different parts of the ship. Only a very small
percentage received slight wounds. Except on board the destroyers
and light cruisers, there were no casualties from the enemy quick-
firers, the missiles[91] failing to penetrate the armoured parts of the
ship. It was a stiff price to pay, and the task of subduing the
Republic of Rioguay was not yet accomplished. There were still the
Rioguayan flying-boats and submarines to be taken into
consideration. Britain's capital ships, though few in number, had
vindicated themselves against superior numbers of hostile surface
ships. Would they be able to confound the enemy and the critics
who so loudly declared that the day of the big battleship was over,
and that air-power would overwhelm the long-standing might of
Britannia's trident?[92]
 CHAPTER XXX

The End of the Rioguayan Air Fleet

Grey dawn revealed the battered Rebound, still steaming stern-

foremost, within the wide estuary of the Rio Guaya. Four miles to
the west'ard lay her three sister-battleships, with their attendant
light cruisers and destroyers, awaiting daybreak before pushing on
up the broad river as far as they could without violating the
territorial waters of San Valodar and San Benito.

There was a widely expressed hope amongst the officers and crew
of the British fleet, that one of these republics would throw in her lot
with the enemy. That would leave the admiral a comparatively free
hand, since he would no longer be obliged to respect the zone over
which either San Valodar or San Benito claimed jurisdiction. As
things stood, there was a curious anomaly. The Rioguayan fleet had
the right to the free use of the river below Sambrombon Island,
although both passages were controlled by neutral states. Until the
British fleet could contrive to obtain sanction, they were unable to
proceed much[93] farther without causing an international affair
which might call for protests from the Powers.

The British air squadron attached to the fleet was also unable to
approach Rioguayan territory, owing to the republic's possession of
Brian Strong's anti-aircraft rays. On their part the Rioguayan flying-
boats were useless against the British fleet, armed as it was with the
ray-projecting apparatus.

The only course open, apparently, was to blockade Rioguay by sea,

but this promised to be a most unsatisfactory operation. The
republic was practically self-supporting; it could still maintain trade
with the neighbouring republics despite any active interference on
the part of the British navy.