ligolo-ng

nicocha30GPL-3.0活跃维护

基于 TUN 虚拟网卡的隧道与内网横向移动工具，让渗透测试人员在拿下入口后轻松穿透多层网络、访问内网主机。

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

v0.9.2发布于 2026-09-26 08:02 UTC5,176star +11 / 7 天504fork同步于 2026-11-10 23:37 UTC

内网穿透隧道横向移动渗透测试 TUN 网卡

对比 GitHub 官网 golang offensive-security pentest-tool pentesting pivoting

怎么上手

由 README 提炼，执行前请确认

原文

README 未给出安装命令，请参考官方文档 https://docs.ligolo.ng/ 的 Quickstart

硬件要求按 README 说明

README 未说明具体硬件或显存要求；relay/proxy 服务端需要能创建 tun 接口（通常需 root 或相应权限），agent 端无需管理员权限。

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼

没人工点评？写下你的经验

用 TUN 接口做隧道与内网穿透的轻量工具，让渗透测试摆脱 SOCKS 代理

基于 TUN 虚拟网卡的隧道与内网横向移动工具，让渗透测试人员在拿下入口后轻松穿透多层网络、访问内网主机。

核心能力

用 TUN 接口转发流量，无需 SOCKS 或 proxychains
基于 Gvisor 用户态网络栈，把 SYN 翻译成远端 connect()
支持 TCP、UDP 和 ICMP echo 请求
agent 端无需 root 权限，可在 agent 上监听和绑定 socket
支持多隧道、反向与绑定连接，断网后自动恢复隧道

容易踩的坑

relay/proxy 服务端必须能创建 tun 接口，agent 端则不需要特权；agent 无特权时无法转发原始数据包，nmap SYN 扫描实际走 connect()，建议加 --unprivileged 或 -PE 避免误报；README 未给出具体安装命令，需按官方文档操作。

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

用户点评

登录用户的真实使用记录，可按版本和硬件筛选

共 0 条

还没有人点评。第一个说出真实体验的人最有价值。

README 原文

未翻译

在 GitHub 打开

Ligolo-ng : Tunneling like a VPN

An advanced, yet simple, tunneling tool that uses TUN interfaces.

GitHub Downloads (all assets, all releases)

📑 Ligolo-ng Documentation (Setup/Quickstart)

[!TIP] Ligolo-ng 0.8 added a lot of new features, including:

🌐 API and a beautiful Web Interface thanks to L'ami du Raisin, allowing multiplayer!

⚙️ Simple configuration file, to keep your tunneling/proxy settings

🚦 Daemon mode, to run Ligolo-ng as a service

🔗 Auto-bind, to automatically configure tunneling whenever a specific agent connects

📶 Easy and automatic (autoroute) route and interface management on Windows, Linux, MacOS and BSD!

💀 Agent kill, to remotely terminate an agent

Please try it out!

Introduction
Features
Demo
How is this different from Ligolo/Chisel/Meterpreter... ?
How to use - documentation - tutorial
Does it require Administrator/root access ?
Supported protocols/packets
Performance
Caveats
Todo
Credits

Introduction

Ligolo-ng is a simple, lightweight and fast tool that allows pentesters to establish tunnels from a reverse TCP/TLS connection using a tun interface (without the need of SOCKS).

Features

Tun interface (No more SOCKS/Proxychains!)
Simple UI with agent selection and network information
Easy to use and setup
Automatic certificate configuration with Let's Encrypt
Performant (Multiplexing)
Does not require privileges on the agent
Socket listening/binding on the agent
Multiple platforms supported for the agent
Can handle multiple tunnels
Reverse/Bind Connection
Automatic tunnel/listeners recovery (in case of network issues)
Websocket support

Demo

Ligolo-ng-demo.webm

How is this different from Ligolo/Chisel/Meterpreter... ?

Instead of using a SOCKS proxy or TCP/UDP forwarders, Ligolo-ng creates a userland network stack using Gvisor.

When running the relay/proxy server, a tun interface is used, packets sent to this interface are translated, and then transmitted to the agent remote network.

As an example, for a TCP connection:

SYN are translated to connect() on remote
SYN-ACK is sent back if connect() succeed
RST is sent if ECONNRESET, ECONNABORTED or ECONNREFUSED syscall are returned after connect
Nothing is sent if timeout

This allows running tools like nmap without the use of proxychains (simpler and faster).

How to use - documentation - tutorial

You will find the documentation for Ligolo-ng, as well as the steps to follow to get it up and running on the Ligolo-ng Documentation

Does it require Administrator/root access ?

On the agent side, no! Everything can be performed without administrative access.

However, on your relay/proxy server, you need to be able to create a tun interface.

Supported protocols/packets

TCP
UDP
ICMP (echo requests)

Performance

You can easily hit more than 100 Mbits/sec. Here is a test using iperf from a 200Mbits/s server to a 200Mbits/s connection.

$ iperf3 -c 10.10.0.1 -p 24483
Connecting to host 10.10.0.1, port 24483
[  5] local 10.10.0.224 port 50654 connected to 10.10.0.1 port 24483
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec  12.5 MBytes   105 Mbits/sec    0    164 KBytes       
[  5]   1.00-2.00   sec  12.7 MBytes   107 Mbits/sec    0    263 KBytes       
[  5]   2.00-3.00   sec  12.4 MBytes   104 Mbits/sec    0    263 KBytes       
[  5]   3.00-4.00   sec  12.7 MBytes   106 Mbits/sec    0    263 KBytes       
[  5]   4.00-5.00   sec  13.1 MBytes   110 Mbits/sec    2    134 KBytes       
[  5]   5.00-6.00   sec  13.4 MBytes   113 Mbits/sec    0    147 KBytes       
[  5]   6.00-7.00   sec  12.6 MBytes   105 Mbits/sec    0    158 KBytes       
[  5]   7.00-8.00   sec  12.1 MBytes   101 Mbits/sec    0    173 KBytes       
[  5]   8.00-9.00   sec  12.7 MBytes   106 Mbits/sec    0    182 KBytes       
[  5]   9.00-10.00  sec  12.6 MBytes   106 Mbits/sec    0    188 KBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   127 MBytes   106 Mbits/sec    2             sender
[  5]   0.00-10.08  sec   125 MBytes   104 Mbits/sec                  receiver

Caveats

Because the agent is running without privileges, it's not possible to forward raw packets. When you perform a NMAP SYN-SCAN, a TCP connect() is performed on the agent.

When using nmap, you should use --unprivileged or -PE to avoid false positives.

Todo

Do not RST when receiving an ACK from an invalid TCP connection (nmap will report the host as up) ;
Add mTLS support.

Credits

Nicolas Chatelain <nicolas -at- chatelain.me>
Jeremie Bedjai (Ligolo-ng-Web)

ligolo-ng

怎么上手

项目说明