A modular AWS privilege escalation exploitation framework with a Metasploit-style REPL, a scriptable CLI, 80+ exploit modules, and interchangeable payloads.
Quick Start • Install • Command Reference ↗ • Contributing
Full documentation and command reference: pathfinding.cloud/pathrunner
Defenders have more misconfigurations than time to fix them. Unlike software CVEs, IAM misconfigurations are hard to triage. How do we know what's actually exploitable versus merely a missing best practice? Pathrunner answers that by demonstrating the escalation, so teams can prioritize the paths that are genuinely exploitable and impactful, and build detections for each step along the way.
Pathrunner has 80+ exploit modules across 20+ AWS services (IAM, EC2, Lambda, STS, ECS, Glue, CloudFormation, SSM, Bedrock, and more) with dozens of interchangeable payloads (credential and HTTPS exfiltration, backdoor role/user/policy creation, reverse shells). The authoritative, always-current counts and the full catalog live at pathfinding.cloud/pathrunner.
Requires Go 1.26+ and valid AWS credentials.
go install github.com/DataDog/pathrunner/cmd/pathrunner@latestbrew tap DataDog/pathrunner https://github.com/DataDog/pathrunner
brew install DataDog/pathrunner/pathrunnerOS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m | sed 's/x86_64/amd64/')
VERSION=$(curl -fsSL https://api.github.com/repos/DataDog/pathrunner/releases/latest | grep '"tag_name"' | cut -d'"' -f4 | tr -d 'v')
curl -fsSL "https://github.com/DataDog/pathrunner/releases/download/v${VERSION}/pathrunner_${VERSION}_${OS}_${ARCH}.tar.gz" | tar -xz pathrunner
sudo mv pathrunner /usr/local/bin/git clone https://github.com/DataDog/pathrunner.git
cd pathrunner
make build
cp pathrunner /usr/local/bin/# Start the interactive shell
./pathrunner
# Add your AWS identity
pathrunner> identity add --profile my-aws-profile
# Browse available modules
pathrunner> search lambda
pathrunner> info lambda-001
# Select and configure a module
pathrunner> use lambda-001
pathrunner> show options
pathrunner> set ROLE_ARN arn:aws:iam::123456789012:role/TargetRole
# Choose a payload and execute
pathrunner> show payloads
pathrunner> set PAYLOAD exfil/response
pathrunner> exploitAfter a successful exploit that captures credentials, they're auto-extracted and available as a new identity:
pathrunner> identity list # New identity appears automatically
pathrunner> identity switch lambda_AB12
pathrunner> pmapper analyze # See what's reachable from hereSee the command reference for every command, module, and payload in detail.
- Dual Interface — CLI and REPL share identical command handlers via adapter pattern
- Decoupled Payloads — Modules query payloads by tags at runtime; payloads self-register via
init() - Workspace Isolation — Each workspace maintains isolated identities, history, and tracked resources
See CONTRIBUTING.md for development setup, testing requirements, and how to add new modules and payloads.
This tool is designed exclusively for authorized security testing and penetration testing activities.
Users are responsible for:
- Ensuring proper authorization before testing any AWS infrastructure
- Compliance with all applicable laws and regulations
- Proper handling and disposal of any credentials or sensitive data accessed
- Understanding that unauthorized access to computer systems is illegal
Ecosystem:
- pathfinding.cloud - The source-of-truth library of AWS IAM privilege escalation paths that pathrunner modules implement
- pathfinding-labs - Terraform lab environments used to deploy and validate pathrunner modules against
Other tools:
- PMapper - AWS IAM privilege escalation analysis; pathrunner can import its graph output
- CloudFox - AWS attack surface enumeration; pathrunner can import its output as a resource store
- Pacu - AWS exploitation framework
- Stratus Red Team - Adversary emulation for cloud, by Datadog
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
- Issues: Open an issue in this repository
- Discussions: Use GitHub Discussions for questions
- Security: For security concerns about this repository, please open a private security advisory
Maintained by Seth Art from Datadog