Ligolo-ng

ligolo-proxy -selfcert -laddr 0.0.0.0:11601

Full network tunnel with WireGuard: the compromised host joins your attack network and you reach the internal network without port proxies.

Run it when you need full network access (not just SOCKS) to launch tools against the internal network: nmap, responder, smbclient from your machine. Ligolo creates a TUN interface on your host and routes to the compromised host's ranges, as if you were inside.

The agent needs root (TUN) on Linux and admin with Wintun on Windows. If egress blocks 11601/TCP, change the port or put a reverse proxy in front. For a single service (like RDP), chisel with R:port is simpler than setting up a full tunnel.