Ligolo-ng: A guide to simple pivoting into an internal network

Ligolo-ng: A guide to simple pivoting into an internal network

Speakers: Jacob Smith (Penetration Tester and Tech Hooligan)

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=hZCVHRfuBBo

Overview

In the realm of ethical hacking and penetration testing, gaining initial access to a target system is often just the first step. The real challenge, and often the most rewarding part, lies in pivoting – extending one's reach into otherwise inaccessible internal networks. Jacob Smith, known by his handle Neoite, delivered a compelling presentation at SAINTCON, shedding light on Ligolo-ng, a powerful yet remarkably simple tool designed to facilitate this crucial stage of an engagement. The talk, titled "Ligolo-ng: A guide to simple pivoting into an internal network," serves as an essential guide for red teamers and penetration testers looking to streamline their internal network access strategies.

Smith’s presentation is not merely a technical walkthrough but also a testament to the practical challenges faced in real-world penetration tests. He recounts his personal struggles with complex network environments and the limitations of conventional pivoting tools, ultimately highlighting how Ligolo-ng emerged as a game-changer. This tool simplifies the intricate process of establishing a robust tunnel into an internal network, allowing attackers to leverage their own sophisticated toolsets from their external machines, effectively treating the internal network as if it were directly accessible.

The significance of Ligolo-ng, as presented by Smith, lies in its ability to cut through the complexity often associated with network pivoting. It addresses a critical pain point for security professionals: how to efficiently and reliably gain full access to segmented or isolated network segments after compromising an initial host. By offering a straightforward, command-line driven solution, Ligolo-ng empowers testers to focus on enumeration and exploitation rather than wrestling with convoluted network configurations, making it an invaluable addition to any ethical hacker's toolkit.

Background

▶ Watch: Introduction to Ligolo-ng and talk overview (0:00)

Pivoting is a fundamental concept in ethical hacking, defined by Smith as "extending your reach to networks that are not directly accessible from your position." It's a critical phase in the ethical hacking cycle, typically occurring after initial access has been gained on a "foothold" machine within a target environment. Once an attacker compromises an internet-facing system or an internal workstation, pivoting allows them to use that compromised machine as a jump point to access other systems deeper within the internal network that are otherwise unreachable from their external attacker machine. This capability is paramount for discovering sensitive assets, escalating privileges, and ultimately achieving engagement objectives, such as compromising an Active Directory domain controller.

The importance of pivoting is underscored by its inclusion in various cybersecurity certifications and real-world penetration testing scenarios. Smith specifically mentions the Practical Network Penetration Tester (PNPT) exam by TCM Security, where pivoting is a mandatory skill for navigating from an initial foothold to compromising an Active Directory environment. He also notes that the Offensive Security Certified Professional (OSCP) exam historically required pivoting, though recent changes with the introduction of "OSCP plus" have shifted focus, often assuming a breach scenario where testers start directly within the internal network. However, for traditional red teaming and penetration testing engagements where an initial external compromise is required, pivoting remains an indispensable technique.

Before discovering Ligolo-ng, penetration testers relied on a variety of methods, each with its own advantages and limitations. These include:

• SoCAT (Socket CAT): A versatile tool used for basic port forwarding, allowing access to a single port on an internal machine. While simple, it often lacks the flexibility for broader network access.
• SSH Local/Dynamic Port Forwarding: Leveraging Secure Shell (SSH) connections to forward ports. Local port forwarding allows access to a single port on a remote machine, while dynamic port forwarding (often used with SOCKS proxies) can provide access to all ports on a single machine or even an entire network segment, akin to a VPN. This method, however, requires SSH credentials or an ID_RSA key on the compromised host.
• SSHuttle: Described by Smith as "almost like a VPN," SSHuttle utilizes SSH credentials to create a transparent proxy, effectively routing all traffic for specified subnets through the SSH connection. It's highly effective but, again, contingent on SSH access.
• Chisel: A fast TCP/UDP tunnel over HTTP, Chisel is a powerful alternative that can create secure tunnels and SOCKS proxies, offering significant flexibility for internal network access.

Smith's personal journey to Ligolo-ng illustrates the practical shortcomings of these established methods in highly secure or complex environments. During an internal penetration test, his company deployed a pre-configured machine to a client's network, simulating an "assumed compromised scenario." His preferred vulnerability scanner, which relied heavily on a graphical interface, was not functioning. Attempts to run a command-line version of the scanner were thwarted by the notorious "Python dependency hell"—a common frustration where incompatible versions or conflicting environments prevent tools from running correctly. After exhausting command-line vulnerability scanning alternatives, Smith realized he simply needed access to a single port hosting his scanner's web interface. However, the client's network was exceptionally secure, blocking all his attempts to establish a connection using SSH, SoCAT, and SSHuttle. It was only after a colleague suggested Ligolo-ng – a tool Smith initially dismissed, preferring his familiar arsenal – that he found a solution. Within 5-10 minutes of trying Ligolo-ng, he had full access to the internal network from his remote attacker machine, underscoring its ease of use and resilience against robust network defenses.

Key Findings

▶ Watch: Importance of pivoting for certifications and red teaming (3:20)

Jacob Smith's talk highlights several key findings regarding Ligolo-ng, positioning it as a highly effective and user-friendly tool for network pivoting:

1. Simplicity and Speed: The most prominent finding is Ligolo-ng's remarkable ease of setup and operation. Smith emphasizes that despite the apparent complexity of network pivoting, Ligolo-ng can be fully operational and provide internal network access within 5 to 10 minutes. This significantly reduces the time and effort typically spent on establishing complex tunnels.

1. Resilience in Secure Environments: Ligolo-ng proved capable of bypassing network restrictions that had thwarted other common pivoting tools like SSH, SoCAT, and SSHuttle during Smith's real-world engagement. This suggests its underlying tunneling mechanism or communication protocols are more adept at traversing restrictive firewalls or network access controls.

1. Proxy-Agent Architecture: The tool operates on a clear proxy-agent model. The "proxy" component runs on the attacker's machine (e.g., Kali Linux), while the "agent" runs on the initially compromised internal machine (e.g., Windows). Understanding this distinction is crucial for correct deployment.

1. Windows Compatibility (CLI-friendly): A significant finding is Ligolo-ng's strong support for Windows environments, even when only command-line access is available on the compromised host. The installation process leverages default Windows command-line tools like curl and tar, making it highly accessible without requiring additional software installations or administrative privileges on the agent side (beyond initial file download and execution).

1. Direct Integration with Kali Linux: Ligolo-ng has been integrated into the Kali Linux apt repository, simplifying its installation on the attacker's side with a single command: apt install legolo-ng.

1. Minimal Command Footprint: The entire setup process, from installing the tool to establishing the tunnel and routing traffic, involves a surprisingly small number of commands (approximately six or seven), making it quick to deploy and less prone to manual error.

1. Limitations and Evasion:

• Windows Defender Detection: Ligolo-ng's agent is caught by Windows Defender by default. This necessitates evasion techniques to prevent the file from being quarantined or blocked during download and execution.
• Unprivileged Agent Limitations: When the agent is not running with privileged access on the compromised machine, certain Nmap scan types may be limited or produce false positives. Smith notes that using specific Nmap flags like -d --unprivileged or -PE can help mitigate these issues and still allow for effective scanning.
• Root/Admin Access for Proxy: While the agent doesn't require root/admin, the proxy (Kali machine) needs root access to add the tun interface.

These findings collectively position Ligolo-ng as a highly practical and efficient solution for penetration testers, particularly those encountering challenging network environments or requiring rapid internal network access after an initial compromise.

Technical Deep Dive

▶ Watch: Overview of different pivoting tools and techniques (4:05)

Ligolo-ng's power lies in its elegant proxy-agent architecture, designed to establish a tun interface on the attacker's machine, effectively creating a Layer 3 tunnel that routes traffic into the target internal network. This allows the attacker's machine to interact with internal hosts as if it were directly connected to that network.

The process involves distinct steps on both the attacker's (proxy) and the compromised internal (agent) machines. Smith primarily focuses on a Kali Linux attacker machine and a Windows internal foothold, demonstrating the tool's versatility.

1. Installation

• Attacker (Kali Linux) - Proxy:

Ligolo-ng is conveniently available in the Kali Linux APT repository. Installation is straightforward:

• Foothold (Windows) - Agent:

Installing the agent on a Windows machine is a manual process, but designed to be command-line friendly.

1. Download the Agent Binary: From the attacker's Kali machine, navigate to the Ligolo-ng GitHub releases page (e.g., github.com/nicocha30/ligolo-ng/releases). Identify the correct agent binary for the target Windows machine's architecture (e.g., windows_amd64_agent.tar.gz).
2. Transfer and Extract: Use curl on the Windows machine to download the agent, then tar to extract it. Smith highlights that both curl and tar are installed by default on modern Windows command lines, simplifying this step.

The -LO flags for curl instruct it to follow redirects (-L) and output the file to its original filename (-O).

2. Setting up the Tun Interface (Kali Proxy)

Before activating the Ligolo-ng proxy, a tun interface needs to be created and brought up on the Kali machine. This virtual network interface will be used by Ligolo-ng to route traffic.

The first command creates a new tun interface named legolo and assigns it to the specified user. The second command brings this interface online. While Ligolo-ng documentation might offer an automated way, Smith advocates for this manual, two-command approach for reliability and understanding.

3. Activating the Proxy (Kali)

With the tun interface ready, the Ligolo-ng proxy can be started on the Kali machine.

The --selfcert flag tells Ligolo-ng to generate and use a self-signed SSL certificate for the connection. For more advanced scenarios, custom certificates can be configured, as detailed in the Ligolo-ng documentation. Once started, the proxy will enter a listening state, awaiting connections from an agent.

4. Windows Agent Driver Installation

For the Ligolo-ng agent to function correctly on Windows and create its own virtual network interface, it requires a specific driver: Windon.

1. Download Windon Driver: Go to the Wind Ton website and find the appropriate driver for the Windows machine.
2. Transfer and Install: Use curl on the Windows machine to download the driver, similar to how the agent binary was downloaded. The driver files then need to be copied to the agent's directory. Smith notes this process is similar to the agent installation.

5. Connecting the Agent (Windows)

Once the Windon driver is in place, the agent can be executed on the Windows foothold machine, initiating a connection back to the Kali proxy.

The . refers to the current working directory, and agent.exe is the extracted Ligolo-ng agent binary. The <attacker_C2_server_IP> is the public IP address of the Kali machine, and <port> is the listening port configured on the proxy (default is often 1194 or similar, though Smith doesn't explicitly state it, implying the default).

6. Activating the Session (Kali)

Upon a successful connection from the agent, the Kali proxy will detect an incoming session. The attacker then needs to activate this session.

This command establishes the tunnel, and the Kali machine now has a logical connection to the internal network via the compromised Windows host.

7. Internal Network Routing (Kali)

The final, crucial step is to add routes on the Kali machine so that traffic destined for the internal network segment is correctly routed through the newly established legolo tun interface.

1. Identify Target Subnet: On the Windows foothold, use ipconfig to determine the internal network's subnet (e.g., 192.168.0.0/24).

Look for an interface with an IP address (e.g., 192.168.0.30) and its corresponding subnet mask or CIDR notation (e.g., /24).

1. Add Route on Kali:

For example, if the internal subnet is 192.168.0.0/24:

After this command, the Kali machine can now directly interact with any machine on the 192.168.0.0/24 network segment, allowing for further enumeration and exploitation with native Kali tools.

Disclaimers and Limitations

Smith also notes important considerations:

• Administrator/Root Access: Only the proxy machine (Kali) requires root access to add the tun interface. The agent on the foothold does not need administrative privileges to run, though downloading and executing might be restricted by other security controls.
• Windows Defender Evasion: The Ligolo-ng agent is typically detected by Windows Defender. Attackers will need to employ evasion techniques (e.g., obfuscation, packing, or memory injection) to bypass this protection.
• Nmap Scan Limitations: When the agent operates without privileged access, Nmap scans might be less effective or produce false positives. Smith suggests using Nmap flags like -d --unprivileged or -PE to mitigate these issues and improve scan accuracy in such scenarios.

This detailed technical walkthrough demonstrates how Ligolo-ng, despite its simplicity, leverages core networking concepts to provide robust and effective internal network pivoting capabilities.

Demo / Proof of Concept

▶ Watch: Speaker's challenge leading to Ligolo-ng discovery (5:45)

While Jacob Smith's presentation did not feature a live, step-by-step demonstration of Ligolo-ng in action, he provided a compelling real-world use case that served as a practical proof of concept. He recounted an internal penetration test where traditional pivoting methods and preferred vulnerability scanning tools failed due to stringent network security and technical challenges.

The scenario involved an "assumed compromised" engagement where his company deployed a pre-configured machine into a client's internal network. Smith's initial plan was to use a vulnerability scanner that relied on a graphical interface, but this interface was non-functional on the deployed machine. Attempts to run a command-line version of the scanner were thwarted by Python dependency hell, a common frustration where conflicting library versions prevent tools from executing correctly. After exploring other command-line vulnerability scanners, which proved unsuitable for red team operations, Smith realized his primary objective was simply to access the web interface of his preferred scanner, which was hosted on a specific port.

However, the client's network was highly secure, actively blocking his attempts to establish a tunnel using common tools like SSH local/dynamic port forwarding, SoCAT, and SSHuttle. These tools, usually reliable, were unable to punch through the network's defenses to connect to the internal machine. It was at this point, after exhausting his familiar arsenal, that a colleague suggested Ligolo-ng.

Initially skeptical and reluctant to learn a new tool, Smith eventually caved under the pressure of the failing engagement. He describes going through Ligolo-ng's documentation, understanding its proxy-agent verbiage, and then attempting the setup. To his surprise and relief, within a mere 5 to 10 minutes, he had successfully established a working tunnel, gaining full access to the internal network from his remote attacker machine. This allowed him to run his vulnerability scanner and complete the engagement effectively.

This personal anecdote serves as a powerful testament to Ligolo-ng's efficacy and ease of use, particularly in challenging environments where other, more established tools might falter. The speaker used diagrams and command-line screenshots from the official Ligolo-ng documentation to illustrate each technical step, reinforcing that the process he described was directly applicable and well-documented. This practical "proof of concept" through lived experience highlights Ligolo-ng's ability to overcome real-world penetration testing hurdles.

Defensive Implications

▶ Watch: Struggles with Python dependencies in vulnerability scanning (7:00)

The insights provided by Jacob Smith on Ligolo-ng offer critical defensive implications for blue teams and security professionals aiming to protect their internal networks. Understanding how tools like Ligolo-ng operate is essential for developing robust detection and prevention strategies.

1. Endpoint Detection and Response (EDR) & Antivirus (AV) Evasion:

Smith explicitly states that Windows Defender catches the Ligolo-ng agent by default. This is a crucial piece of information for defenders. Blue teams should ensure their EDR and AV solutions are up-to-date and configured to actively detect and block known Ligolo-ng agent binaries. However, attackers are aware of this, meaning they will likely employ evasion techniques such as obfuscation, packing, or custom compilation to bypass these defenses. Defenders should therefore focus on behavioral detection, looking for suspicious process execution patterns (e.g., curl downloading executables, tar extracting them, unknown executables making outbound connections), rather than just signature-based detection.

1. Network Segmentation and Egress Filtering:

Ligolo-ng works by establishing an outbound connection from the compromised internal agent to the external attacker proxy. Strong network segmentation can limit the impact of a successful pivot. If an initial foothold is gained on a highly segmented network, the attacker's ability to pivot to other critical segments might be restricted. More importantly, strict egress filtering on internal machines can prevent the Ligolo-ng agent from connecting back to an arbitrary external C2 server IP address and port. By default, internal hosts should only be allowed to make necessary outbound connections. Any unusual outbound traffic, especially to non-standard ports or unknown external IPs, should be flagged.

1. Monitoring for Tunnel Interfaces and Routing Changes:

On Linux systems (like the Kali proxy), Ligolo-ng creates a tun interface and modifies the system's IP routing table. While this occurs on the attacker's machine, defenders should be aware that similar techniques might be used by other tunneling tools on compromised Linux servers within their network. Monitoring for the creation of new virtual network interfaces or unauthorized modifications to routing tables (e.g., ip tundap add, ip route add) could indicate malicious activity.

1. Least Privilege Principle:

Smith mentions that the Ligolo-ng agent does not require administrative privileges on the Windows foothold. This reinforces the importance of the principle of least privilege. Even if an attacker gains control of a low-privileged user account or process, they can still establish a pivot. Ensuring that user accounts and applications have only the minimum necessary permissions can limit the attacker's ability to download and execute arbitrary binaries, even if they don't require full admin rights.

1. Traffic Analysis and Anomaly Detection:

Ligolo-ng traffic, while encrypted, might exhibit characteristic patterns. Defenders should monitor network traffic for anomalies:

• Unusual protocols or traffic volumes from internal hosts to external IPs.
• Connections to IP addresses not typically associated with legitimate business traffic.
• Long-lived, persistent outbound connections that don't match known application behavior.

Deep Packet Inspection (DPI) or Network Intrusion Detection Systems (NIDS), if capable of decrypting or analyzing SSL/TLS traffic, might provide additional insights, though custom certificates or self-signed certificates might make this challenging.

1. User Awareness and Initial Foothold Prevention:

Ultimately, Ligolo-ng requires an initial foothold. Preventing the initial compromise through robust patching, strong authentication, phishing awareness training, and secure configurations remains the most effective defense. If an attacker cannot gain initial access, they cannot pivot.

By implementing a multi-layered defense strategy that combines endpoint security, stringent network controls, continuous monitoring, and adherence to security best practices, organizations can significantly reduce the risk posed by advanced pivoting tools like Ligolo-ng.

Key Takeaways

• Ligolo-ng simplifies network pivoting: The tool offers a remarkably fast and easy way to establish full internal network access from an external attacker machine, often within 5-10 minutes.
• Proxy-Agent Architecture: It operates using a clear proxy (attacker machine, e.g., Kali) and agent (compromised internal machine, e.g., Windows) model, requiring specific setup steps on both ends.
• Bypasses Strict Network Controls: Ligolo-ng has proven effective in environments where traditional pivoting tools like SSH, SoCAT, and SSHuttle were blocked, highlighting its resilience against robust network defenses.
• Windows-Friendly, Even CLI-Only: The agent can be deployed and run on Windows machines with only command-line access, leveraging default Windows tools like curl and tar for installation.
• Defensive Challenges: The Ligolo-ng agent is detected by Windows Defender by default, necessitating evasion techniques. Defenders should focus on comprehensive EDR, network segmentation, strict egress filtering, and monitoring for unusual network activity and tunnel interface creation.
• Nmap Scan Limitations: While powerful, the unprivileged Ligolo-ng agent on the foothold might limit certain Nmap scan types, though specific Nmap flags can help mitigate false positives.

About the Speaker(s)

Jacob Smith, who goes by the handle Neoite, is a dedicated professional in the cybersecurity field. He has accumulated approximately three and a half years of experience as a contract penetration tester. In addition to his contracting work, he holds a full-time position as an Information Security Engineer.

Smith's journey into cybersecurity began unexpectedly. After returning from a "2-year vacation for the church," he initially pursued a path in medicine, quickly discovering a strong dislike for biology. His brother then "tricked" him into taking a free ethical hacking course, which turned out to be "The Complete Guide to Ethical Hacking by TCM Security." This course, combined with his subsequent attendance at SAINTCON (where he was presenting), completely hooked him on the industry. Jacob Smith is based in Utah.