Ligolo-MP Guide Demonstrates Multi-Hop Network Pivoting

Summary

A hands-on lab guide shows how Ligolo-MP coordinates agents, routes and TCP redirectors for single- and double-hop pivoting, localhost-only service access and compile-time agent obfuscation, highlighting risks from weak segmentation and egress controls.

Key points

• The guide demonstrates routing through a Debian pivot to reach an isolated subnet, then using a Windows agent for a second hop to a Domain Controller subnet.
• A TCP redirector on the Debian pivot forwards the Windows agent’s connection to the Ligolo-MP server through the existing tunnel.
• Ligolo-MP manages operator and agent sessions, TUN devices, routes and redirectors, and also offers SOCKS and HTTP proxy capabilities.
• Loopback routing lets the operator reach an Apache service bound only to 127.0.0.1 on the pivot host.
• The guide describes compile-time agent obfuscation that changes names and string literals, claiming it can improve evasion of signature-based detection.
• The article identifies weak network segmentation, lack of egress filtering and unchecked lateral movement as defensive concerns.

MITRE ATT&CK

Products

Tools