$ show nicocha30/ligolo-ng
Ligolo-ng is a tunneling tool designed for penetration testing that creates secure tunnels from reverse TCP/TLS connections using TUN interfaces. Unlike traditional tools that rely on SOCKS proxies, Ligolo-ng implements a userland network stack using gvisor to translate packets between the TUN interface on the proxy server and target networks accessed through compromised agents. This allows security professionals to run tools like nmap directly through the tunnel without requiring proxychains or other proxyification tools. The system consists of two main components: an agent that runs on target machines and establishes outbound connections to the proxy, and a proxy server that manages agent connections, creates TUN interfaces, and handles traffic routing. The proxy features a rich CLI interface for managing agents, establishing tunnels, configuring listeners, and viewing network information, with an optional web API and UI for graphical management. Communication between agent and proxy is secured via TLS and multiplexed using yamux for efficient handling of multiple simultaneous connections. Key technical innovations include a sophisticated packet relaying mechanism that preserves UDP datagram boundaries while transmitting error information back through the tunnel, cross-platform TUN interface abstraction that works on Linux, BSD, and Windows, and flexible TLS certificate management supporting self-signed certificates, Let's Encrypt automation, and custom certificate files. The tool demonstrates careful attention to reliability features like automatic reconnection, interface recovery after connection drops, and proper resource cleanup.
The LLM identified 3 files worth highlighting for reuse:
Provides a flexible certificate management system that abstracts multiple certificate sources (files, Let's Encrypt via autocert, and self-signed certificates) with automatic caching. Demonstrates the strategy pattern for switching between certificate sources and implements proper caching to minimize regeneration overhead. Can be extracted for any Go application needing configurable TLS setup.
Implements reliable data relaying between connections with specialized handling for framed packet relays that preserve UDP datagram boundaries. Features innovative error propagation mechanism that sends network errors back through the stream tunnel using a custom frame format. Demonstrates the proxy pattern for connection forwarding with enhanced error handling capabilities.
Provides a unified interface for TUN/TAP interface creation, route management, and interface information across Linux, BSD, and Windows platforms. Abstracts platform-specific implementations (netlink on Linux, route syscalls on BSD, wintun/wireguard on Windows) behind a common API. Demonstrates the abstraction layer pattern for handling platform differences in network management.