Discovering New AWS Privilege Escalation Paths with an AI-Driven Workflow

Discovering New AWS Privilege Escalation Paths with an AI-Driven Workflow

Speakers: Seth Art, Penetration Tester

Conference: fwd:cloudsec

YouTube: https://www.youtube.com/watch?v=y7ANSpQYD-g

Overview

Seth Art's presentation at fwd:cloudsec dives into an innovative, AI-driven workflow designed to identify novel privilege escalation (PE) paths within Amazon Web Services (AWS) Identity and Access Management (IAM). As cloud environments become increasingly complex and multi-account, traditional methods of discovering and cataloging vulnerabilities struggle to keep pace. Art, a penetration tester, shares his journey from an initial ambition to build a modular exploitation framework to the creation of an extensive catalog of known paths and, critically, a methodology for uncovering previously unresearched attack vectors.

The talk highlights the critical need for a structured approach to cloud security research, particularly concerning cross-account and multi-hop privilege escalation. Art's work, which evolved over nine months, demonstrates how leveraging Large Language Models (LLMs) and autonomous agents can significantly accelerate the identification of complex attack patterns across a vast and ever-expanding service landscape. By detailing his research process, the tools he developed—pathfinding.cloud and Pathrunner—and the new vulnerabilities unearthed, Art provides both offensive and defensive security professionals with valuable insights and resources to navigate the evolving AWS threat landscape.

This research is particularly significant because it addresses the inherent dynamism of cloud platforms. New AWS services and features are constantly introduced, potentially creating unforeseen interactions and privilege escalation opportunities. Art's methodology offers a scalable and semi-automated way to stay ahead of these developments, ensuring that the security community can identify and mitigate risks in novel attack surfaces, even in less commonly audited services.

Background

▶ Watch: Project genesis: modular exploitation to new research (0:50)

Seth Art's journey began with the ambitious goal of developing Pathrunner, a modular exploitation framework akin to Metasploit, specifically tailored for AWS IAM privilege escalation. His vision for Pathrunner included support for diverse exploit paths, modular payloads adaptable to different attacker preconditions, and the ability to manage multiple compromised identities. However, a fundamental challenge quickly emerged: to build an offensive tool, one first needs a robust collection of vulnerable infrastructure to test against.

This necessity led Art down a rabbit hole of creating numerous AWS labs, each designed to validate a specific exploit module. As the number of labs grew, so did the need for standardization. He realized the importance of developing a consistent taxonomy and schema to ensure uniformity across these testing environments. This organizational effort eventually culminated in the creation of pathfinding.cloud, a public catalog intended to document previously researched privilege escalation paths. Early foundational research by Spencer Gessen in 2019, particularly his iam-vulnerable project, served as a baseline, but Art recognized its limitation: it primarily focused on single-account scenarios. His experience as a penetration tester consistently revealed that real-world attacks frequently involved multi-hop and cross-account privilege escalation, demanding a broader research scope.

To address these complexities, Art adopted a Terraform-based approach for lab creation, seeking to enhance interaction through a Command Line Interface (CLI) and Terminal User Interface (TUI), drawing inspiration from tools like Stratus Red Team. This marked his initial foray into using advanced AI capabilities, specifically Claude's slash commands and sub-agents, to automate the generation and validation of these intricate lab environments. The workflow involved an orchestrator receiving a high-level description, generating a YAML schema, distributing tasks to specialized sub-agents (e.g., resource creation, attack script generation), and finally, a scenario validator ensuring consistency. A key lesson learned during this phase was the importance of schema versioning to manage updates to the lab definitions over time.

Central to understanding privilege escalation, Art emphasized the distinction between required permissions—those absolutely necessary to execute an attack—and helpful permissions, which streamline the process but aren't strictly mandatory. He illustrated this with the CreateAccessKey example: while creating an access key is the core action, knowing which user to target (enumeration) is helpful but might be acquired through other means (e.g., external documentation). Furthermore, preconditions play a crucial role. For instance, CreateAccessKey typically fails if a user already has two access keys. However, Art discovered that certain additional permissions, like DeleteAccessKey, could negate such preconditions, allowing an attacker to first remove an existing key before creating a new one, thereby exchanging permissions for the removal of a precondition. This nuanced understanding of permission interaction became a cornerstone of his subsequent research.

Key Findings

▶ Watch: AI-driven workflow for lab creation using Claude (4:00)

Art's extensive research yielded several significant findings, transforming the landscape of AWS privilege escalation knowledge. Initially driven by the need to populate his pathfinding.cloud catalog, he successfully documented 65 known atomic paths, providing a centralized, programmatically accessible resource for the security community. This catalog quickly gained traction, with established open-source tools like Prowler and Cloudplaining integrating its data, vastly expanding their coverage of known AWS attack vectors.

The most groundbreaking finding, however, emerged from Art's innovative application of an AI-driven workflow to discover new privilege escalation paths. By feeding the workflow existing pathfinding.cloud patterns and instructing it to search for similar patterns within the AWS SDK for Go (or any SDK) across unresearched services, his system generated 15 hypotheses. Impressively, four of these worked on the first iteration, and another five were confirmed after one to three iterations of bug fixing. This semi-autonomous approach demonstrated the immense potential of LLMs and agents in accelerating security research.

Collaborating with a colleague named Xander, who implemented a fully autonomous agent approach using the Python Boto SDK and an API key, Art's research further expanded. Xander's agent autonomously validated hypotheses by attempting various turns to overcome errors, leading to the confirmation of additional paths. Art subsequently built his own two-agent system—one for generating hypotheses and another for validating them—further solidifying this autonomous research methodology.

In total, Art and his collaborators confirmed 17 new privilege escalation paths. A particularly striking aspect of these discoveries was their presence in services often considered obscure or less frequently audited. While some paths were found in well-known services like Batch and Elastic MapReduce (EMR), others emerged in services Art himself had never encountered, such as Bracket, GameLift, and Mix. This highlights a critical blind spot in cloud security: the vast and continuously expanding surface area of AWS services, where similar vulnerabilities can manifest even in niche offerings.

From these 17 new paths, Art identified four recurring patterns of privilege escalation:

1. Command Injection Style Attacks: Archetyped by SSM StartSession or SendCommand, this pattern involves injecting malicious commands into service configurations. New instances were found affecting Batch and EC2 Launch Templates.
2. Code Injection (Inline): This pattern involves directly embedding malicious code (e.g., Python) within an AWS command, often in a way not explicitly intended by the service design.
3. Code Injection (Reference): The largest category, where an AWS command points to an external or internal resource (e.g., S3 bucket, container image) containing malicious code that is then executed by the service.
4. Infrastructure as Code (IaC) Archetype: Similar to how CloudFormation defines infrastructure, services like Step Functions can be manipulated to define and execute malicious actions, effectively acting as an IaC-driven exploit.

These findings not only expand the known attack surface but also provide a framework for understanding and anticipating future privilege escalation vectors in AWS.

Technical Deep Dive

▶ Watch: Importance of schema versioning for consistent labs (4:50)

Art's core innovation lies in his sophisticated AI-driven workflow, which leverages Large Language Models (LLMs) like Claude to orchestrate complex security research tasks. The workflow begins with a workflow orchestrator that receives a high-level natural language description of a desired lab scenario or research objective. This orchestrator then translates the description into a structured YAML schema, which defines the AWS resources, permissions, and attack steps necessary for the lab.

This YAML schema is then passed to a series of specialized sub-agents, each responsible for a distinct part of the lab creation and validation process. For instance, one sub-agent might provision the necessary AWS resources using Terraform, another might generate the specific IAM policies, and a crucial one creates the demo attack script. Art emphasized the importance of schema versioning to manage updates to the lab definitions over time, allowing for a dedicated sub-agent to automatically migrate older lab configurations to the latest schema.

A key technical aspect of Art's research involves the precise definition of permissions and preconditions. He meticulously separates required permissions (the absolute minimum set to execute an attack) from helpful permissions (those that simplify enumeration or overcome specific obstacles). For example, while iam:CreateAccessKey is a required permission for that specific PE path, the precondition max_keys < 2 (user has fewer than two access keys) can be overcome if the attacker also possesses iam:DeleteAccessKey. This demonstrates a sophisticated understanding of how permissions can interact and negate preconditions, a dynamic often overlooked in simpler analyses.

The demo attack script is a critical component for deterministic validation of LLM-generated labs. For each lab, this script:

1. Starts with the credentials of the initial, compromised user.
2. Attempts a forbidden action (e.g., creating an S3 bucket in a restricted account) to confirm the user does not already have administrative access.
3. Executes the privilege escalation steps defined in the lab.
4. Re-attempts the previously forbidden action to confirm that the privilege escalation was successful and the user now has the necessary permissions.

This deterministic check ensures the reliability and reproducibility of the generated labs.

The pathfinding.cloud catalog, born from this workflow, serves as a public resource for atomic paths. It leverages an attack visualization sub-agent to graphically represent attack chains, with clickable edges detailing the AWS CLI commands involved. A notable feature is the concept of modular payloads, represented by blue boxes in the visualizations. These payloads offer flexibility for attackers; for example, if an EC2 instance is compromised, one payload might exfiltrate credentials to a Command and Control (C2) server, while another might perform malicious actions directly within the instance if egress is blocked. All paths are programmatically accessible via a paths.json file, facilitating integration with other security tools.

The methodology for discovering new paths involved querying the AWS SDK for Go (or any SDK) for API calls that mirrored patterns found in pathfinding.cloud, particularly those involving resource creation or modification that could accept arbitrary code or roles. Art's colleague Xander developed an autonomous agent using the Python Boto SDK and an API key. This agent could independently attempt privilege escalation, learn from errors, and iterate through different permission combinations over a set number of "turns" to confirm or deny a hypothesis. Art later built his own two-agent system, one for generating hypotheses and another for validating them using the pathfinding.cloud lab approach in a standalone project.

A detailed example of a new path is the Kinesis Analytics privilege escalation. This path requires a compromised victim with iam:PassRole, kinesisanalytics:CreateApplication, and kinesisanalytics:StartApplication permissions. The attacker pre-stages a malicious Java JAR file in an attacker-controlled S3 bucket. The attack proceeds as follows:

1. The attacker uses kinesisanalytics:CreateApplication to create a Kinesis Analytics application, pointing it to the malicious JAR in their S3 bucket and specifying a role (via iam:PassRole) to be assumed by the application.
2. The attacker then uses kinesisanalytics:StartApplication, which causes the Kinesis service to retrieve and execute the malicious JAR file.
3. The JAR file, crafted to escalate privileges, runs within the Kinesis service context, effectively granting the victim administrative access.

Another intriguing example is a CodeDeploy path involving codedeploy:CreateDeployment. Art highlighted that this single AWS CLI command actually required four distinct IAM permissions to execute successfully. This demonstrates that some AWS API calls are not a one-to-one mapping to a single permission, but rather abstract multiple backend operations, each requiring its own permission. This complexity makes manual discovery challenging and underscores the value of autonomous agents in uncovering such intricate permission dependencies.

Finally, Art reintroduced Pathrunner, his original Metasploit-like framework, now enriched by the research. Pathrunner supports workspaces for multi-client penetration testing, maintains command history, and crucially, manages multiple identities. It features modular payloads for services like EC2 (three options) and Lambda (multiple options). Art demonstrated how Pathrunner could use the Lambda UpdateCode module with an Xfill response payload to automatically extract environment variables (including credentials) from a compromised Lambda function and import them as a new identity into Pathrunner's identity store, facilitating multi-hop privilege escalation.

Demo / Proof of Concept

▶ Watch: Exchanging permissions for overcoming attack preconditions (6:30)

While the presentation did not feature live, interactive demonstrations of the attacks in real-time, Seth Art thoroughly described the mechanisms and functionality of his tools and the privilege escalation paths, effectively serving as a conceptual demonstration. He detailed how the demo attack script functions as a deterministic proof-of-concept for each newly generated or validated lab. This script ensures that a lab starts with a limited user, confirms their lack of administrative access, performs the privilege escalation, and then verifies the newly acquired administrative capabilities. This systematic approach forms the bedrock for proving the existence and exploitability of each path.

Art provided a detailed walkthrough of the Kinesis Analytics privilege escalation path as a concrete proof-of-concept. He explained the exact permissions required (iam:PassRole, kinesisanalytics:CreateApplication, kinesisanalytics:StartApplication) and the attacker's setup (a malicious Java JAR in an S3 bucket). The "demo" here was a step-by-step explanation of the attack flow: first, creating the Kinesis application configured to use the malicious JAR and an assumable role, and then starting the application, which triggers the execution of the JAR and subsequent privilege escalation. This serves as a blueprint for how an attacker would execute this specific exploit.

Furthermore, Art showcased the capabilities of Pathrunner, his modular exploitation framework. He demonstrated its core functionalities, such as managing multiple identities and modular payloads. Specifically, he walked through a scenario using the Lambda UpdateCode module. The demonstration highlighted Pathrunner's ability to:

1. Autodiscover target Lambda functions within an environment.
2. Select a specific payload, such as the "Xfill response" payload, designed to extract environment variables from the compromised Lambda function.
3. Upon successful invocation of the modified Lambda function, automatically parse the exfiltrated environment variables (which contain credentials).
4. Import these credentials as a new identity into Pathrunner's identity store, enabling seamless transitions between compromised roles or users for further multi-hop attacks.

Although not a live execution, the detailed explanation of these processes effectively demonstrated the practical application of his research and tools, illustrating how they can be used to identify, exploit, and manage privilege escalation scenarios in AWS environments.

Defensive Implications

▶ Watch: Validating AI-generated labs with demo attack scripts (7:10)

The insights from Seth Art's research have profound implications for defenders operating within AWS environments. The discovery of 17 new privilege escalation paths, particularly in less-frequently audited services like Bracket, GameLift, and Mix, underscores that the attack surface is far broader and more dynamic than commonly perceived. Defenders must expand their auditing scope beyond core services and apply the principles of least privilege to all AWS offerings.

The pathfinding.cloud catalog itself is a critical defensive resource. By providing a public, programmatically accessible database (paths.json) of 65 known atomic paths, it enables organizations to proactively check their IAM policies against documented vulnerabilities. Security teams can integrate this data into their existing Cloud Security Posture Management (CSPM) tools or develop custom scripts to identify if any of their IAM roles or users possess the specific combinations of permissions that constitute a known privilege escalation vector. The speaker noted that tools like Prowler and Cloudplaining have already integrated this information, significantly enhancing their ability to detect misconfigurations.

Art's breakdown of required vs. helpful permissions and the role of preconditions provides a more nuanced understanding for policy design. Defenders should not only focus on blocking obviously dangerous permissions but also analyze how seemingly innocuous combinations of permissions, or the ability to negate preconditions (e.g., DeleteAccessKey to overcome max_keys limits), could lead to privilege escalation. This calls for a shift towards more holistic and context-aware IAM policy evaluation.

The identified patterns of privilege escalation—command injection, code injection (inline and reference), and infrastructure as code archetypes—offer a framework for anticipating future threats. Defenders should scrutinize services that allow for arbitrary code execution (e.g., Lambda, Batch, Kinesis Analytics, CodeDeploy), external resource referencing (e.g., S3 buckets, container images), or infrastructure definition (e.g., Step Functions), paying close attention to the permissions associated with these capabilities. The iam:PassRole permission, frequently seen in these attack chains (e.g., Kinesis Analytics), remains a high-risk permission that demands stringent controls and careful auditing.

The autonomous agent methodology for discovering paths highlights the dynamic nature of AWS security. New features and service interactions can inadvertently create new vulnerabilities. While Art's research is offensive in nature, the underlying methodology suggests a path for defensive research: developing similar autonomous agents to continuously monitor for new service capabilities or permission interactions that could introduce risk. The speaker also explicitly encouraged collaboration on hooking this research up to dynamic feeds of new AWS features to create "big warning signs" for potential new vulnerabilities.

In summary, defenders should:

• Broaden their audit scope: Include less-common AWS services in their security assessments.
• Leverage pathfinding.cloud: Integrate its data into policy checks and CSPM tools.
• Adopt a granular view of permissions: Analyze combinations and preconditions, not just individual permissions.
• Prioritize iam:PassRole audits: Strictly control and monitor its usage.
• Scrutinize code execution services: Pay extra attention to services that can run arbitrary code or reference external resources.
• Consider automated research: Explore using AI-driven approaches to proactively identify new risks in a constantly evolving cloud environment.

Key Takeaways

• AI-Driven Research Accelerates Discovery: Leveraging LLMs and autonomous agents can significantly speed up the discovery of novel AWS privilege escalation paths, identifying vulnerabilities that might be overlooked by manual methods.
• Expanding Attack Surface in Obscure Services: New privilege escalation paths are not limited to common AWS services but are also found in less-audited offerings like Bracket, GameLift, and Mix, broadening the scope of necessary security audits.
• Nuance of Permissions and Preconditions: Effective privilege escalation often involves understanding the interplay between required and helpful permissions, as well as how additional permissions can negate specific preconditions, allowing for more complex attack chains.
• Categorization of Attack Patterns: Newly discovered paths fall into distinct patterns, including command injection, code injection (inline and reference), and infrastructure as code archetypes, providing a framework for anticipating future vulnerabilities.
• Open-Source Tools for Offense and Defense: Resources like pathfinding.cloud (a catalog of 65 paths) and Pathrunner (a modular exploitation framework) empower both penetration testers to execute attacks and defenders to proactively identify and mitigate risks.
• Deterministic Validation is Crucial: The use of demo_attack_scripts provides a deterministic and reproducible method for validating LLM-generated labs and confirming the success of privilege escalation, ensuring the reliability of security research.

About the Speaker(s)

Seth Art is a Penetration Tester whose work focuses on identifying and exploiting vulnerabilities in cloud environments, particularly AWS. His presentation at fwd:cloudsec showcases his deep expertise in AWS IAM privilege escalation, a domain he has actively researched and contributed to over several years. Art's practical experience as a penetration tester heavily influences his research, driving him to focus on multi-hop and cross-account privilege escalation paths, which he frequently encounters in real-world engagements.

He is the creator of iam-vulnerable, an earlier Terraform-based learning environment for AWS privilege escalation, and the driving force behind the development of pathfinding.cloud, a public catalog of AWS IAM privilege escalation paths. His ongoing work includes Pathrunner, a modular exploitation framework designed to operationalize these findings. Art's commitment to open-source contributions and his innovative use of AI in security research position him as a thought leader in cloud security.