XUTS LABS
Back to Red Team Playbooks
PivotingRed Team Playbook

Ligolo Pivoting

Use Ligolo tun routing for scoped internal access through an approved pivot host.

LigoloPivotingRouting

Purpose

Create predictable pivot routes while avoiding persistent global tunnels.

Inputs

  • - LHOST
  • - pivot host
  • - internal CIDR
  • - interface name

Prerequisites

  • - Approved pivot host
  • - Ligolo binaries
  • - Allowed internal CIDR
  • - Operator route privileges

Operator Assumptions

  • - Routes are engagement-specific.
  • - Tunnel startup order matters.

Commands

Create tun interface

Kali
sudo ip tuntap add user $USER mode tun ligolo && sudo ip link set ligolo up

Why: Prepare local routing interface.

Expected: Interface ligolo is up.

Start proxy

Kali
ligolo-ng proxy -selfcert

Why: Wait for agent sessions.

Expected: Proxy listening and ready for agent.

Add scoped route

Kali
sudo ip route add INTERNAL_CIDR dev ligolo

Why: Route only the approved internal network through Ligolo.

Expected: Traffic to INTERNAL_CIDR uses ligolo.

Decision Points

  • - If agent cannot connect, check firewall/NAT.
  • - If only one service is needed, SOCKS may be enough.
  • - Remove route when engagement work ends.

Follow-On Actions

  • - Internal Nmap
  • - Web discovery
  • - Evidence capture

Evidence To Capture

  • - Interface state
  • - Session log
  • - Route table
  • - Scoped scan output

Common Failures

  • - Route overlaps local network
  • - Agent architecture mismatch
  • - Proxy certificate confusion

Operational Cautions

  • - Do not start global persistent tunnels.
  • - Keep routes limited to approved scope.

Related Content

Ask EXO