What is Ligolo-ng?#

Ligolo-ng is a very useful tool for pivoting and tunneling during lab environments, pentesting and offensive infrastructure preparation. It lets you route traffic toward internal networks through an agent and a proxy, without depending on a traditional VPN.

In this post I leave a basic and functional configuration to bring up the ligolo interface, start the proxy and connect the agent.

Prepare the TUN interface on the attacker machine#

First, delete any previous configuration and recreate the interface:

1
# Remove previous configuration if it exists
2
sudo ip link delete ligolo 2>/dev/null
3
sudo ip tuntap add user $(whoami) mode tun ligolo
4
sudo ip link set ligolo up

1
ip link show ligolo

Start the Ligolo-ng proxy#

On the attacker machine:

1
cd ~/tools/ligolo/proxy
2
./proxy -selfcert -laddr 0.0.0.0:11610

That process will leave the proxy listening on port 11610. Don’t close that terminal while the session is active.

Connect the agent#

1
./agent -connect 10.10.14.157:11610 -ignore-cert

1
./agent.exe -connect 10.10.14.157:11610 -ignore-cert

Start the session and route the internal network#

After running start inside Ligolo-ng, add the route on your attacker machine toward the network you want to reach:

1
sudo ip route add 172.16.5.0/24 dev ligolo

With that, traffic destined for that network will be sent through the ligolo interface.

Summarized flow#

1
# 1. Prepare interface
2
sudo ip link delete ligolo 2>/dev/null
3
sudo ip tuntap add user $(whoami) mode tun ligolo
4
sudo ip link set ligolo up
5

6
# 2. Verify
7
ip link show ligolo
8

9
# 3. Start proxy
10
cd ~/tools/ligolo/proxy
11
./proxy -selfcert -laddr 0.0.0.0:11610
12

13
# 4. Connect Linux agent
14
./agent -connect 10.10.14.157:11610 -ignore-cert
15

16
# 5. Connect Windows agent
17
./agent.exe -connect 10.10.14.157:11610 -ignore-cert
18

19
# 6. After running start in Ligolo, add the route
20
sudo ip route add 172.16.5.0/24 dev ligolo

Recommendation#

Before adding routes, check carefully which subnet the active session shows you and make sure you’re not clobbering routes that already exist on your attacker machine. If you work with several internal networks, documenting each segment and each interface saves you quite a few mistakes during pivoting.