Post Exploitationtunnelingreverse-tcpreverse-tlstun-interfacepentesting

Ligolo-ng Common Binaries

Prebuilt binaries for Advanced ligolo-ng, a simple, lightweight and fast tool that allows pentesters to establish tunnels from a reverse TCP/TLS connection using a tun interface without the need of SOCKS.

Description

ligolo-ng-common-binaries provides prebuilt binaries for ligolo-ng across multiple platforms and architectures. Ligolo-ng is designed for pentesters to create tunnels using reverse TCP or TLS connections via a tun interface, offering an efficient alternative to SOCKS proxies. The package includes agent and proxy binaries for Darwin, Linux, and Windows on both AMD64 and ARM64 architectures.

These binaries are stored in /usr/share/ligolo-ng-common-binaries after installation, making them readily available for deployment in penetration testing scenarios. The tool supports cross-platform usage, enabling agents to run on target systems and proxies on the attacker's machine to facilitate network tunneling.

Use cases include establishing persistent tunnels during post-exploitation phases to access internal networks without relying on traditional proxy methods.

How It Works

Ligolo-ng operates by deploying an agent on the target system that establishes a reverse TCP or TLS connection to a proxy server controlled by the pentester. The proxy utilizes a tun interface to route traffic, creating a tunnel that bypasses the need for SOCKS proxies. This setup allows for fast and lightweight network access from the attacker's machine through the tun interface.

Installation

bash
sudo apt install ligolo-ng-common-binaries

Examples

Displays help information and lists the directory structure of prebuilt binaries in /usr/share/ligolo-ng-common-binaries
ligolo-ng-common-binaries -h
Lists all available prebuilt binaries for ligolo-ng agents and proxies
ls /usr/share/ligolo-ng-common-binaries
Runs the Linux AMD64 agent binary (typical usage on target Linux system)
/usr/share/ligolo-ng-common-binaries/ligolo-ng_agent_0.8.3_linux_amd64
Runs the Linux AMD64 proxy binary (typical usage on attacker's Kali machine)
/usr/share/ligolo-ng-common-binaries/ligolo-ng_proxy_0.8.3_linux_amd64
Runs the Windows AMD64 agent binary on a target Windows system
/usr/share/ligolo-ng-common-binaries/ligolo-ng_agent_0.8.3_windows_amd64.exe
Runs the Darwin ARM64 proxy binary on macOS Apple Silicon
/usr/share/ligolo-ng-common-binaries/ligolo-ng_proxy_0.8.3_darwin_arm64
Updated 2026-04-16kali.org ↗