commands.yaml

# Handler-private and legacy commands — winbox-ipc
#
# When SYS_CMD (0xFF0007) is NOT in the 0xFE0000-0xFE0016 range, it is
# either:
#   * a handler-private u32 with top byte = process_id (see processes.yaml)
#     and low 16 bits the handler-local opcode, e.g. 0x0A0065 = mepty
#     login command; or
#   * a legacy u8-encoded short-form value (cmdGet=7, cmdOpen=5, ...) used
#     in pre-mepty auth flows.
#
# Drained from winbox-m2-semantics.yaml `commands:` section. The full
# handler-private command catalogs (mepty, mproxy, undo) belong here once
# this project's PROTOCOL.md and MarginResearch are drained.
---
m2ir-version: 0.1
schema-version: 0.1

profile: winbox-ipc
appears-in: { field: 0xff0007, name: SYS_CMD }

# ── handler-private (process_id-prefixed u32 values) ────────────────────
handler-private:
  0x0a0065:
    canonical-name: meptyLogin
    process-id: 0x0a
    process-name: mepty
    confidence: documented
    evidence:
      - source: code
        ref: "this project's PROTOCOL.md and working code"
    notes: "Project-named; consistent with the process_id=0x0a convention."

  0x0a0067:
    canonical-name: meptyData
    process-id: 0x0a
    process-name: mepty
    confidence: documented
    evidence:
      - source: code
        ref: "this project's PROTOCOL.md"

# ── documented handler-scoped u8 command spaces ──────────────────────────
handler-scoped-u8:
  mproxy-handler-2:
    canonical-name: mproxy-file-transfer
    handler-path:
      process-id:
        value: 0x02
        version-range: "6.30.1-6.42.x"
        notes: |
          Tenable's public CVE-2018-14847 PoC targets [2,2]. Process ids are
          version-scoped through system.x3, so this should not be treated as
          a universal `mproxy` assignment outside the affected v6 range.
      handler-id: 2
    confidence: documented
    evidence:
      - source: code
        ref: "tenable/routeros poc/bytheway"
        url: "https://github.com/tenable/routeros/blob/master/poc/bytheway/src/main.cpp"
      - source: code
        ref: "tenable/routeros 8291_honeypot"
        url: "https://github.com/tenable/routeros/blob/master/8291_honeypot/README.md"
      - source: doc
        ref: "n0p — WinBox bug dissection"
        url: "https://blog.n0p.me/2018/05/2018-05-21-winbox-bug-dissection/"
    notes: |
      These u8 SYS_CMD values are handler-scoped, not global short forms.
      The same numeric values can carry different meanings in other
      handlers. The older n0p/BASUCERT write-up independently describes the
      same two-request file-transfer surface as the pre-auth list / file
      retrieval path, including a changing session byte echoed from one
      request/response pair into the next.
    commands:
      0x07:
        canonical-name: fileOpen
        encoding: { tcodes: [0x09] }
        args:
          - { key: 0x000001, name: path, tcodes: [0x20, 0x21], role: "absolute file path" }
        response:
          - { key: 0x000002, tcodes: [0x08, 0x09], role: "file size in bytes" }
          - { key: 0xfe0001, name: STD_ID, role: "session context for follow-up reads" }
        notes: "CVE-2018-14847 open-file request. Honeypot logs show SYS_TO=[2,2], SYS_CMD=7, and a string key 1 path."
      0x04:
        canonical-name: fileRead
        encoding: { tcodes: [0x09] }
        args:
          - { key: 0xfe0001, name: STD_ID, role: "session id returned by fileOpen" }
          - { key: 0x000002, tcodes: [0x08, 0x09], role: "number of bytes to read" }
        response:
          - { key: 0x000003, tcodes: [0x30, 0x31], role: "raw file content" }
        notes: "CVE-2018-14847 follow-up read request after a prior fileOpen."

# ── legacy u8 short-form values ─────────────────────────────────────────
# Encoded as tcode 0x09 (1-byte SYS_CMD). Pre-handler shortcuts; not
# STD_CMD_* (those start at 0xFE0000).
legacy-short-form:
  0x01:
    canonical-name: cmdLogin
    confidence: observed-only
    notes: |
      Project uses u8 CMD=1 in legacy login step. No name in any source.
      Corroborated by a private third-party WinBox client implementation's
      pre-6.43 MD5 fallback flow: final step sends SYS_TO=[13,4], CMD=1,
      with session id + username (field 1) + salt (field 9, raw, echoed
      from the challenge step) + hashed password (field 10, raw:
      0x00 || MD5(0x00 || password || salt)).
    evidence:
      - source: code
        ref: "private third-party WinBox client implementation (server-side monitoring product; source not publicly available)"

  0x04:
    canonical-name: cmdChallenge
    confidence: observed-only
    notes: |
      Project uses u8 CMD=4 in the 'request challenge' step of legacy auth.
      Not a universal short-form label: Tenable documents the same u8 value
      as `fileRead` inside the mproxy/handler-2 command space. Corroborated
      by a private third-party implementation's flow: sent to SYS_TO=[13,4]
      with the session id from the prior list step; the reply's field 9
      (raw, namespace USER) is the salt used in the cmdLogin MD5 hash.
    evidence:
      - source: code
        ref: "private third-party WinBox client implementation (server-side monitoring product; source not publicly available)"

  0x05:
    canonical-name: cmdOpen
    confidence: observed-only
    notes: |
      u8-encoded. Used in the legacy MD5 auth handshake (cmdOpen / Step
      2a). Corroborated by a private third-party implementation: sent to
      SYS_TO=[2,2] with the session id obtained from the cmdGet/list step;
      reply not otherwise consumed before proceeding to cmdChallenge.
    evidence:
      - source: code
        ref: "private third-party WinBox client implementation (server-side monitoring product; source not publicly available)"

  0x07:
    canonical-name: cmdGet
    confidence: observed-only
    notes: |
      Encoded as u8 (tcode 0x09) in this project; a private third-party
      implementation instead encodes the same CMD=7 value as u32 (tcode
      0x08) — consistent with profile.yaml's documented 0x08/0x09
      compact-pair (both are valid `u32 kind` tcodes; 0x09 is just the
      1-byte form for small values), not a conflict. Not a STD_CMD_*
      (those start at 0xFE0000). Pre-handler 'shortcut' for the
      system-info path in this project's auth flow. Distinct from
      CMD_GET=0xFE000D, and also distinct from the documented
      mproxy/handler-2 `fileOpen` command that reuses u8 value 7 in a
      different handler context. The third-party implementation's legacy
      flow sends this CMD=7 to SYS_TO=[2,2] with string field 1 = "list"
      (not a path) to bootstrap a session id before cmdOpen/cmdChallenge/
      cmdLogin — see ./gui-handlers.yaml for its distinct post-auth
      reuse of CMD=7 (as cmdGet, u8, to [13,4]) for source-id adoption.
    evidence:
      - source: code
        ref: "private third-party WinBox client implementation (server-side monitoring product; source not publicly available)"

investigation-trail:
  - date: 2026-05-03
    finding: |
      Only the mepty handler's two commands (login, data) and four legacy
      short-forms are drained from the strawman. The full mepty +
      mproxy + undo command spaces are still pending — see README.md
      §Status step 4.
  - date: 2026-05-04
    finding: |
      Added the public mproxy/handler-2 fileOpen/fileRead surface from
      Tenable's CVE-2018-14847 material. The remaining gap is the rest of
      the mproxy, mepty, and undo command catalogs outside the documented
      public PoCs.
  - date: 2026-05-04
    finding: |
      Added n0p/BASUCERT as an independent corroborating source for the
      handler-2 file-transfer flow: the same open/read surface underlies the
      unauthenticated list/file retrieval path, and it carries a changing
      session byte between the paired requests.