Edit

Pivoting using Ligolo-Ng

Prerequisites

Linux

When using Linux, you need to create a tun interface on the Proxy Server (C2):

$ sudo ip tuntap add user [your_username] mode tun ligolo
$ sudo ip link set ligolo up

Tip

On Ligolo-ng >= v0.6, you can now use the interface_create command to create a new interface! No need to use ip tuntap!

ligolo-ng » interface_create --name "evil-cha"
INFO[3185] Creating a new "evil-cha" interface...       
INFO[3185] Interface created!

Windows

You need to download the Wintun driver (used by WireGuard) and place the wintun.dll in the same folder as Ligolo (make sure you use the right architecture).

TLS Options

Using Let's Encrypt Autocert

When using the -autocert option, the proxy will automatically request a certificate (using Let's Encrypt) for attacker_c2_server.com when an agent connects.

Info

Port 80 needs to be accessible for Let's Encrypt certificate validation/retrieval

Using your own TLS certificates

If you want to use your own certificates for the proxy server, you can use the -certfile and -keyfile parameters.

Automatic self-signed certificates

The proxy/relay can automatically generate self-signed TLS certificates using the -selfcert option.

Validating self-signed certificates fingerprints (recommended)

When running selfcert, you can run the certificate_fingerprint command to print the currently used certificate fingerprint.

On the agent, you can then connect using the fingerprint provided by the Ligolo-ng proxy.

Warning

By default, the ligolo domain name is used for TLS Certificate generation. You can change the domain by using the -selfcert-domain [domain] option at startup.

Ignoring all certificate verification (for lab/debugging)

To ignore all security mechanisms, the -ignore-cert option can be used with the agent.

Warning

Beware of man-in-the-middle attacks! This option should only be used in a test environment or for debugging purposes.

Using Ligolo-ng

Basic Tunnel

Start the Ligolo-ng proxy server

Start the proxy server on your Command and Control (C2) server (default port 11601):

Start the agent

Start the agent on your target (victim) computer (no privileges are required!):

Info

If you want to tunnel the connection over a SOCKS5 proxy, you can use the --socks ip:port option. You can specify SOCKS credentials using the --socks-user and --socks-pass arguments.

A session should appear on the proxy server.

Use the session command to select the agent.

Start the tunneling

Start the tunnel on the proxy, using the evil-cha interface name.

Info

On macOS, you need to specify a utun[0-9] device, like utun4.

Setup routing

Ligolo-ng managed routing

Manual routing setup

First, display the network configuration of the agent using the ifconfig command:

Then setup routes accordingly to your system:

Using the terminal:

Or using the Ligolo-ng (>= 0.6) cli:

REFERENCES

PreviousReverse Relays - MetasploitNextActive Directory Pentesting

Last updated

Was this helpful?