TLS Tunneling (Ligolo-ng)
MITRE ATT&CK™ Protocol Tunneling - Technique T1572
Last updated
Was this helpful?
MITRE ATT&CK™ Protocol Tunneling - Technique T1572
Last updated
Was this helpful?
(Golang) is a network pivoting tool that allows us to establish tunnels from a reverse TCP/TLS connection using a tun interface (without the need of SOCKS).
It utilizes a local proxy server and remote agents to make process tunneling from remote hosts simple and easy to manage. It has features other tools lack, such as building a network interface in the system userland that does not require elevated privileges to establish and encrypt VPN tunneling.
First, start the proxy server on the Attacking Host or Jump Box:
On the compromised host, after uploading the agent, we use the following command:
When the agent connect back to the server, we must enumerate its network as follow:
Take note of interesting agent interfaces that may be use for pivoting, and add the route on the proxy/relay server. In this example we'll do as follow
Finally, start the tunnel on the ligolo proxy server:
Done ! We can now access the 10.10.10.0/24 agent network from the proxy server.
fisrt need to be configured. We need to create a tun interface on the Proxy Server (Attacking Host, or Jumb Box):
