Mike Swanson
d62a14ca4e
Six small bash scripts uploaded to /tmp on 172.16.3.22 during the OwnCloud cron stacking incident — investigation, group enumeration, failed group-restrict attempt, occ subcommand discovery. Captured for audit; full context in clients/pavon/session-logs/2026-04-29-session.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
11 lines
475 B
Bash
11 lines
475 B
Bash
#!/bin/bash
|
|
echo "=== PAVON USER DETAILS ==="
|
|
sudo -u apache php /var/www/owncloud/occ user:list-groups pavon 2>&1
|
|
echo
|
|
echo "=== ALL USERS WITH GROUPS ==="
|
|
for u in $(sudo -u apache php /var/www/owncloud/occ user:list 2>&1 | awk -F': ' '{print $2}' | tr -d ' '); do
|
|
[ -z "$u" ] && continue
|
|
grps=$(sudo -u apache php /var/www/owncloud/occ user:list-groups "$u" 2>&1 | grep -E '^\s+-' | awk -F'- ' '{print $2}' | paste -sd, -)
|
|
echo "$u: ${grps:-(no groups)}"
|
|
done
|