nicocha30/ligolo-ng
Ligolo Ng
Ligolo-ng is a network tunneling framework and control server designed for managing remote agents and coordinating network routing. It functions as a reverse tunneling proxy and a site-to-site VPN tool, utilizing a userland TUN interface to pivot network traffic through remote agents.
The project distinguishes itself by using a TUN interface routing system to forward TCP, UDP, and ICMP traffic through multiple remote agents. It implements a C2 model where a central server manages remote agents to bypass firewall restrictions and provide direct subnet access to isolated networks.
The system covers a broad range of networking capabilities, including multi-hop pivot routing, protocol-agnostic packet encapsulation, and mutual authentication via automated certificate management. It also provides tools for network agent management, persistent route definition, and remote traffic redirection.
Features
- Network Agent Management Servers - Provides a central control server that manages remote agents, handles tunnels, and provides automatic recovery from network failures.
- Agent-Managed TUN VPNs - Provides an agent-managed VPN that creates a TUN interface on the relay server to tunnel traffic to isolated networks.
- Remote Management Agents - Manages and controls remote agents from a central server to provide direct subnet access and traffic redirection.
- Network Pivoting Tools - Routes network traffic through remote agents to access isolated networks and bypass firewall restrictions.
- Tunnel Agents - Selects agents, views network details, and handles several tunnels at once with automatic recovery from network issues.
- Reverse Proxy Tunneling Tools - Establishes tunnels initiated from remote agents to a central server for accessing internal networks without inbound ports.
- Multiplexed - Multiplexes multiple TCP, UDP, and ICMP connections over a single reverse tunnel connection.
- Multi-Hop Routing - Forwards traffic through multiple agents in sequence to reach deeply nested network environments.
- Agent-Based - Creates a virtual network interface on the relay server that forwards packets to a remote agent over a reverse connection.
- TUN Interface Pivots - Routes network traffic by creating a virtual TUN interface that forwards raw IP packets through the tunnel.
- Certificate-Based Authentication - Uses automated TLS certificate management to authenticate both the server and remote agents.
- Command-and-Control Models - Provides a central control server that manages remote agents and coordinates routing decisions.
- Unprivileged Agent Operations - Operates the agent component without needing administrative or root permissions on the target machine.
- Multi-Protocol Packet Encapsulation - Forwards TCP, UDP, and ICMP traffic through a single encrypted tunnel without protocol-specific handling.
- High-Throughput Tunnels - Multiplexes connections to sustain transfer rates exceeding 100 Mbits per second through the tunnel.
- Bidirectional Tunnel Initiation - Creates tunnels initiated from the agent or from the relay server to suit different network setups.
- Site-to-Site VPN Networking - Connects separate networks as if they were directly linked using a TUN interface and encrypted tunnels.
- Multi-Hop Routing - Forwards traffic through multiple remote agents in sequence for multi-hop routing.
- Userspace Network Stacks - Implements network protocol handling entirely in user space without requiring kernel module modifications.
- TLS and WebSocket Tunnel Encryption - Encrypts the tunnel connection using TLS and optionally sends it over WebSocket to work through restrictive networks.
- Network Tunneling Tools - Advanced tunneling tool for creating SOCKS5 proxies and port forwarding.
- Network Utilities - Advanced tunneling tool for pivoting through compromised hosts.
- Network Exploitation and Tunneling - Lightweight tool for establishing network tunnels via reverse connections.
- Network Tunneling - Advanced tunneling tool utilizing a TUN interface.
- Network Tunneling and Proxying - Tool for tunneling traffic using TUN interfaces.
