Mike Swanson
d62a14ca4e
Six small bash scripts uploaded to /tmp on 172.16.3.22 during the OwnCloud cron stacking incident — investigation, group enumeration, failed group-restrict attempt, occ subcommand discovery. Captured for audit; full context in clients/pavon/session-logs/2026-04-29-session.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
21 lines
800 B
Bash
21 lines
800 B
Bash
#!/bin/bash
|
|
OCC="sudo -u apache php /var/www/owncloud/occ"
|
|
echo "=== ALL versions:* COMMANDS ==="
|
|
$OCC list 2>&1 | grep -E '^\s+versions:'
|
|
echo
|
|
echo "=== ALL trashbin:* COMMANDS ==="
|
|
$OCC list 2>&1 | grep -E '^\s+trashbin:'
|
|
echo
|
|
echo "=== versions:cleanup HELP ==="
|
|
$OCC versions:cleanup --help 2>&1 | head -25
|
|
echo
|
|
echo "=== versions:expire HELP ==="
|
|
$OCC versions:expire --help 2>&1 | head -25
|
|
echo
|
|
echo "=== files_versions DIR STATE BEFORE ==="
|
|
du -sh /owncloud/pavon/files_versions 2>&1
|
|
find /owncloud/pavon/files_versions -type f 2>/dev/null | wc -l
|
|
echo
|
|
echo "=== filecache rows for pavon's versions ==="
|
|
mysql owncloud --skip-column-names <<<'SELECT COUNT(*) FROM oc_filecache fc JOIN oc_storages s ON fc.storage=s.numeric_id WHERE s.id="home::pavon" AND fc.path LIKE "files_versions/%"' 2>&1
|