A modular AWS privilege escalation exploitation framework with dual CLI/REPL interfaces.
Pathrunner automates exploitation of AWS IAM privilege escalation paths. It's the execution layer of a three-project ecosystem:
pathfinding.cloud (path definitions) → pathfinding-labs (deployable labs) → pathrunner (automated exploitation)
- pathfinding.cloud documents each privilege escalation path (prerequisites, permissions, manual exploitation steps)
- pathfinding-labs deploys the vulnerable AWS infrastructure to practice against
- pathrunner (this project) automates the exploitation itself, chaining modules and payloads to escalate from an initial identity to elevated access
Modules reference a pathfinding.cloud path ID when they implement a documented path, and are validated against deployed pathfinding-labs scenarios.
- Dual Interface: Includes a Metasploit style REPL for interactive use and a non-interactive CLI for automation use cases
- Multi-Identity Management: Import, use, and switch between multiple AWS identities seamlessly
- Workspace Persistence: JSON-based workspace storage with command logging and resource tracking
- Resource Tracking: Automatic tracking of created AWS resources with interactive cleanup when permissions allow
- Auto-Discovery: Modules automatically enumerate valid option values (roles, subnets, instance profiles) via AWS APIs when permissions allow
- PMapper Integration: Import pmapper graph data to see which possible paths you can currently exploit with pathrunner
- CloudFox Integration: Import cloudfox output to browse discovered AWS resources and use them as module option values
- Credential Auto-Import: When a payload captures new credentials, they're automatically extracted and added to your identity store for continued escalation
Pathrunner currently includes 83 exploit modules across 22 AWS services (IAM, EC2, Lambda, STS, ECS, Glue, CloudFormation, SSM, and more) with 37 interchangeable payloads (credential exfiltration, HTTPS exfiltration, backdoor role/user/policy creation, reverse shells).
Requires Go 1.25+ and valid AWS credentials.
go install github.com/DataDog/pathrunner/cmd/pathrunner@latestbrew tap DataDog/pathrunner https://github.com/DataDog/pathrunner
brew install DataDog/pathrunner/pathrunnerOS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/')
VERSION=$(curl -fsSL https://api.github.com/repos/DataDog/pathrunner/releases/latest | grep '"tag_name"' | cut -d'"' -f4 | tr -d 'v')
curl -fsSL "https://github.com/DataDog/pathrunner/releases/download/v${VERSION}/pathrunner_${VERSION}_${OS}_${ARCH}.tar.gz" | tar -xz pathrunner
sudo mv pathrunner /usr/local/bin/git clone https://github.com/DataDog/pathrunner.git
cd pathrunner
make build
cp pathrunner /usr/local/bin/# Start the interactive shell
./pathrunner
# Add your AWS identity
pathrunner> identity add --profile my-aws-profile
# Browse available modules
pathrunner> search lambda
pathrunner> info lambda-001
# Select and configure a module
pathrunner> use lambda-001
pathrunner> show options
pathrunner> set ROLE_ARN arn:aws:iam::123456789012:role/TargetRole
# Choose a payload and execute
pathrunner> show payloads
pathrunner> set PAYLOAD exfil/response
pathrunner> exploitAfter a successful exploit that captures credentials, they're auto-extracted and available as a new identity:
pathrunner> identity list # New identity appears automatically
pathrunner> identity switch lambda_AB12
pathrunner> pmapper import # Auto-detects PMapper data directory
pathrunner> pmapper analyze # See what's next from hereImport Principal Mapper graph data to identify escalation paths and get actionable next steps:
pathrunner> pmapper import # Auto-detects PMapper data directory
pathrunner> pmapper analyze # Show escalation paths for current identity
pathrunner> pmapper analyze --all # Show paths for all workspace identities
pathrunner> pmapper status # Graph metadata and module coverageFor each escalation hop, pathrunner shows the matching module and suggested commands to execute it.
Import CloudFox output to browse discovered AWS resources and populate module options:
pathrunner> cloudfox import # Auto-detects ~/.cloudfox/cloudfox-output/aws/
pathrunner> cloudfox import --path /path/to/cloudfox-output
pathrunner> resources list # List all imported resources
pathrunner> resources list ec2 # Filter by service (ec2, lambda, iam, s3, ...)
pathrunner> resources list --wide # Include ARN and resource type columns
pathrunner> resources summary # Overview of imported resource counts by service
pathrunner> resources clear # Remove all imported resources for current workspaceResources are workspace-scoped and auto-populated as available option values when setting module options.
pkg/
├── core/ # REPL shell, identity management, workspace persistence
├── cli/ # Cobra CLI wrapper (1:1 with REPL commands)
├── modules/ # Module system: interfaces, registry, search/filter
├── payloads/ # Payload registry: tag-based filtering, service subdirectories
├── exploits/ # Exploit modules (83), each embedding BaseModule
├── discovery/ # Reusable AWS enumeration (roles, subnets, streams, etc.)
├── pmapper/ # PMapper graph import, querying, and module mapping
├── resources/ # CloudFox output import, resource store, and service-filtered display
├── utils/ # Credential extraction from env vars, JSON, Python dicts
└── config/ # Application configuration
Key design patterns:
- Dual Interface — CLI and REPL share identical command handlers via adapter pattern
- Decoupled Payloads — Modules query payloads by tags at runtime; payloads self-register via
init() - Workspace Isolation — Each workspace maintains isolated identities, history, and tracked resources
- Auto-Refresh — SSO tokens and profile credentials are rebuilt on-demand
See CONTRIBUTING.md for development setup, testing requirements, and how to add new modules and payloads.
This tool is designed exclusively for authorized security testing and penetration testing activities.
Users are responsible for:
- Ensuring proper authorization before testing any AWS infrastructure
- Compliance with all applicable laws and regulations
- Proper handling and disposal of any credentials or sensitive data accessed
- Understanding that unauthorized access to computer systems is illegal
The developers assume no liability for misuse of this tool.
Ecosystem:
- pathfinding.cloud - The source-of-truth library of AWS IAM privilege escalation paths that pathrunner modules implement
- pathfinding-labs - Terraform lab environments used to deploy and validate pathrunner modules against
Other tools:
- PMapper - AWS IAM privilege escalation analysis; pathrunner can import its graph output
- CloudFox - AWS attack surface enumeration; pathrunner can import its output as a resource store
- Pacu - AWS exploitation framework
- Stratus Red Team - Adversary emulation for cloud, by Datadog
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
- Issues: Open an issue in this repository
- Discussions: Use GitHub Discussions for questions
- Security: For security concerns about this repository, please open a private security advisory
Maintained by Seth Art from Datadog