Show version and haiku, but not only: looking for all hidden Junos commands

Hello!

This article is about the hidden commands of the Junos operating system. Those who worked with Juniper equipment running the Junos OS (this includes the MX, SRX, EX, QFX, T, J series, and many others) probably know that in addition to the “official” (documented) commands in the system there are undocumented ones. Their peculiarity is that they are not visible in the command line interface by contextual help (this is when you enter a question mark) and auto-completion does not work for them, that is, you need to know the command and enter it completely (all letters). Apparently, the most famous (and most useless) of these teams is show version and haiku, which gives out a "Japanese" three-poem about the life of network engineers.

There are actually many hidden teams. Vendor does not give their complete list anywhere, but, for example, on the official Juniper forum there is a sticky topic with a rather large set. So the manufacturer does not object to our use of such commands, they simply do not give any guarantee - it can work, or it can put your equipment.

In this article I will talk about how you can get a list of all hidden Junos operating mode commands, within some initial branch. The method is based on a rather simple observation, but by googling I could not find evidence that the question was posed in this form before. An example Python script is included.

Idea

The basic idea of ​​the approach is very simple, but to understand it, it’s still good to have access to the CLI of any Junos device.

Consider, for example, the “show version” command. If we enter “show version a” (at the end - we always press Enter), then the output of the command is like this:

lab@jsrxA-1> show version a
                           ^
syntax error.

And if "show version c", then

lab@jsrxA-1> show version c   
                          ^
syntax error, expecting .

In the first case, there is a hidden extension (and haiku), in the second - no. As you can see, the response of the CLI in the presence of a hidden continuation differs in two aspects:

• "Syntax error." Instead of "syntax error, expecting ‹command›."
• a hat (aka circumflex) stands under the next line position.

Accordingly, sorting the letters one after another (although it’s better to automate them manually), we can find the hidden commands - Junos himself tells them, although not as explicitly as with ordinary commands!

Preliminary notes

Before writing a script, I must warn readers that hidden commands were hidden by the developer for a reason. Some of them may disrupt the device, damage the file system, etc. Therefore, they, even one at a time, should be used with great care. In our case, when a search is done by brute force, this warning is raised to such an extent that in no case should you run such a script on user-processing equipment. After all, we sort through all the commands, which may include file delete, request system zeroize, restart routing, and much more. So play only with pieces of iron that are not connected to the network, which are not a pity to kill, but rather with virtual SRX (aka Firefly Perimeter).

It should also be clarified that although Junos has a very convenient and advanced XML-based API, it is not possible to use it for this task, since our approach to finding commands is based on the specifics of the CLI. Therefore, we will open a regular telnet session, give commands and parse text output.

In this article I will limit myself to searching for operating mode commands. There is also a configuration, and it also has a lot of interesting things hidden (the same commit full). Search for hidden commands there can be carried out similarly.

Algorithm

So, starting with a specific command (commandStart in the script), we will go around all possible options for the commands, adding a character each time (from the alphabet array) and entering Enter. The output sent by Junos in response may be as follows:

1. Swearing about “syntax error.” (And at the same time the hat indicates the presence of the continuation of the command) - a sign of the presence of a hidden command, iterate further, adding new characters.
2. Swearing about "syntax error, expecting ‹command›." -
   here it is necessary to analyze the position of the cap. If it is on the current letter, as above in the “show version c” example, then we do not go further, there are no hidden commands.
   If she indicates the continuation of the command, as here:
   

   lab@jsrxA-1> show version and 
                                 ^
   syntax error, expecting .
   

   
   then in this case the team has a continuation and it is necessary to go further (the team here may be hidden or not, depending on the background).
   
3. Just the output of the command, without swearing about syntax errors, but it is possible with swearing about ambiguous input, for example, like here:
   

   lab@jlab-Firefly-3> show chassis cluster i
                                             ^
   'i' is ambiguous.
   Possible completions:
     interfaces           Display chassis cluster interfaces
     ip-monitoring        Display IP monitoring related information
   

   
   In this case, the search must be continued, because further, a hidden command may be contained (in this case, show chassis cluster information).
   

It is also necessary to take into account that the outputs of some commands may occupy several screens, which leads to the issuance of the invitation "--- (more) ---". In this case, just a helmet space.

Script

Actually, here it is (or on github ).

Examples of work:



As you can see, the script marks some commands as incomplete - those that are supposed to continue. In the event that the continuation of the Junos command no longer hides, such a command is also located in the script, but it is issued in an abbreviated form (show chassis message-statistics i is show chassis message-statistics ipc).

There were no goals to process the script with any possible errors and situations, so if you have a synax error line in the interface descriptions that the script responds to or logging to the terminal is turned on, the operation logic may break.

Another problem is commands that accept any name as an input, for example, show interfaces AnyInterfaceNameIsOKHere (in the absence of such an interface an error is generated, other similar commands may not produce anything). For obvious reasons, the script when setting it on show interfaces crashes with an error about maximum recursion depth exceeded. But the search with commandStart = "show interfaces ge-0/0/0" works fine:

Conclusion

It should be understood that a significant part of hidden commands are hidden due to the fact that they are not supported (or do not make sense) on this equipment or in this version of software. Many of them are useless, however, among them there are "nuggets" (for example, show chassis cluster information). Since I work as a Juniper instructor, I often hear from students a question - where to get a list of all hidden teams. So now I will refer all to this article. I hope that someone will benefit from this recipe.