Local port redirect

[SecT0uch]

What is there a way to expose expose ports listening on localhost ?

I have a Linux proxy and a Windows agent that can communicate through an OpenVPN tunnel (both in 10.10).
On the agent 127.0.0.1:3306 is listening.

I run in the proxy:
listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:3306 --tcp

I can't add the route to the Windows host as it disconnects the agent.

I added a forged route: ip route a 42.42.42.42 dev ligolo and it seems the packets a forwarded to the agent but no response in return.

[nicocha30]

This is a good question.

This could be possible by using an iptables rule... I will add this feature in the future.

[jesuspabloalfaro]

+1 bump on this. Would make a great addition especially for OSCP takers looking for a better alternative to chisel B)

[Thy-GoD]

I was having this exact problem trying to do an iptables black magic fuckery, pls save my sanity.

[nicocha30]

@SecT0uch @jesuspabloalfaro @Thy-GoD
Implemented in latest Ligolo-ng (v0.5.1) release.
https://github.com/nicocha30/ligolo-ng?tab=readme-ov-file#access-to-agents-local-ports-127001

[jesuspabloalfaro]

you are the best! side note, i passed OSCP thanks to ligolo <3

[StayPirate]

@SecT0uch @jesuspabloalfaro @Thy-GoD Implemented in latest Ligolo-ng (v0.5.1) release. https://github.com/nicocha30/ligolo-ng?tab=readme-ov-file#access-to-agents-local-ports-127001

How does it behave in case of multiple connected agents?

[SecT0uch]

How does it behave in case of multiple connected agents?

Unfortunately I didn't have the occasion to use it yet. :/

[StayPirate]

I connected two agents to the proxy, routed 240.0.0.1 to the ligolo tun interface. When I try to reach that IP from my machine (where the proxy runs) the traffic is forwarded to the first connected agent (session 1). I then switched to session 2 on the proxy TUI, with the command session selecting the second session, then i tried to reach out 240.0.0.1 again, but still the first agent replied.

@nicocha30 how should we use this feature to forward local ports from a different agent?

[nicocha30]

@StayPirate switching to another session will not change the current "routing".
You need to start a relay on the other agent (and specify another interface using start --tun ligolo2), then change your system routing table to forward packets to 240.0.0.1 via ligolo2.