Mike Swanson
d62a14ca4e
Six small bash scripts uploaded to /tmp on 172.16.3.22 during the OwnCloud cron stacking incident — investigation, group enumeration, failed group-restrict attempt, occ subcommand discovery. Captured for audit; full context in clients/pavon/session-logs/2026-04-29-session.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
22 lines
561 B
Bash
22 lines
561 B
Bash
#!/bin/bash
|
|
echo === LOAD ===
|
|
uptime
|
|
echo
|
|
echo === CIFS UTILS ===
|
|
rpm -q cifs-utils 2>&1
|
|
which mount.cifs 2>&1
|
|
echo
|
|
echo === EXISTING SMB MOUNTS ===
|
|
mount | grep -iE 'cifs|smb|172.16.3.21' || echo "(none)"
|
|
echo
|
|
echo === SUBDIR FILE COUNTS ===
|
|
for d in /owncloud/pavon/files/*/; do
|
|
name="${d#/owncloud/pavon/files/}"
|
|
name="${name%/}"
|
|
count=$(find "$d" -maxdepth 4 -type f 2>/dev/null | wc -l)
|
|
echo "$count files: $name"
|
|
done
|
|
echo
|
|
echo === ESTIMATED FILES OLDER THAN 365 DAYS ===
|
|
find /owncloud/pavon/files -type f -mtime +365 2>/dev/null | wc -l
|