# Ligolo-ng

Source: <https://github.com/nicocha30/ligolo-ng>

##

### Set up the network

```
$ sudo ip tuntap add user [your_username] mode tun ligolo 
$ sudo ip link set ligolo up
```

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F8kImfPYpHdUkxww6vkkW%2Fimage.png?alt=media&#x26;token=30a752d5-60a1-4b0c-bbc7-1aa66a410869" alt=""><figcaption><p>set this on Kali/C2 Server</p></figcaption></figure>

## Pivoting

My environment:&#x20;

* <mark style="color:red;">Kali</mark> = C2 Server

* Debian = <mark style="background-color:orange;">target</mark>

* <mark style="color:blue;">Windows</mark> = Agent

* <mark style="color:red;">Kali</mark> (c2) doesn't communicate with the <mark style="background-color:orange;">Target</mark>

* [x] So, we'll create the tunneling and after that we can access the <mark style="background-color:orange;">target</mark> via <mark style="color:red;">Kali</mark> directly without the use of *Proxychains*

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F8KHuIWTfvj8b2eNmHbPT%2Fimage.png?alt=media&#x26;token=71633853-0936-4bb9-a864-8aa3fcb3b118" alt=""><figcaption><p>Diagram of my Network</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FJx8NnPVhGTsBJNj6Wu3h%2Fimage.png?alt=media&#x26;token=9425f603-bbba-4595-9e37-5ac749d29d38" alt=""><figcaption><p>Open the Server</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F8AUbEYfWgyhg9Hos0GRY%2Fimage.png?alt=media&#x26;token=0355636a-a12d-4f78-819d-a9dff8defbf5" alt=""><figcaption><p>Connect the Agent to the Server</p></figcaption></figure>

* Here we can access the Session + number
* Type *help* to view all commands
* We can add a Listener to grab to Move Laterally
* But in this case, we just wanna look at the network with **ifconfig**

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FWJClbw735qYdSgf7nPSm%2Fimage.png?alt=media&#x26;token=6b49be9e-67b2-458d-ac23-432953752baa" alt=""><figcaption><p>ifconfig in the session</p></figcaption></figure>

* We've "found" a new network
* We can add it in the Kali/C2

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FNMC6HrGz7pkP56aBWXy0%2Fimage.png?alt=media&#x26;token=919ffa4a-a68d-4072-a108-c580dd82070e" alt=""><figcaption><p>Vmware interface</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FkXPpvsKft7eDgP9UUQ4p%2Fimage.png?alt=media&#x26;token=51c86f64-cbcc-4bc7-a0a7-629f00e8fb8b" alt=""><figcaption><p>Add the route</p></figcaption></figure>

* In my target machine, I opened a web server in the 3rd machine (Isolated) just for demonstration

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FsgdHJpCK0orQxhkVeJIr%2Fimage.png?alt=media&#x26;token=41b57903-5639-4d82-86c1-665da93a8260" alt=""><figcaption><p>Web server in the 3rd machine (Isolated)</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FA9RB7954WbxNoE3VfeOl%2Fimage.png?alt=media&#x26;token=7b98f14c-1011-4ac4-b13a-8d533dea0fca" alt=""><figcaption><p>Start the tunneling on the Session of the Kali/C2</p></figcaption></figure>

* [x] Now we can access the Target machine directly&#x20;

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2F0HmuMBsGOZXSL0EwIZMj%2Fimage.png?alt=media&#x26;token=7bf83f1c-0215-4715-b539-834696790b55" alt=""><figcaption><p>Nmap the Target</p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FjJhs5HoiRogwxcpcCt8p%2Fimage.png?alt=media&#x26;token=7a6aec22-b15b-4dac-9db9-0f70aa2fe0b9" alt=""><figcaption><p>Curl the webserver </p></figcaption></figure>
