Pivoting & Portforwarding
Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.
Last updated
Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network.
Last updated
Start the proxy server on your Command and Control (C2) server (default port 11601):
Start the agent on your target (victim) computer (no privileges are required!):
If you want to tunnel the connection over a SOCKS5 proxy, you can use the
--socks ip:portoption. You can specify SOCKS credentials using the--socks-userand--socks-passarguments.
A session should appear on the proxy server.
session command to select the agent.Add a route on the proxy/relay server to the 192.168.0.0/24 agent network.
Linux:
Windows:
You can listen to ports on the agent and redirect connections to your control/proxy server.
In a ligolo session, use the listener_add command.
The following example will create a TCP listening socket on the agent (0.0.0.0:1234) and redirect connections to the 4321 port of the proxy server.
On the proxy:
When a connection is made on the TCP port 1234 of the agent, nc will receive the connection.
This is very useful when using reverse tcp/udp payloads.
You can view currently running listeners using the listener_list command and stop them using the listener_stop [ID] command: