Forward from Windows with OpenSSH, Plink or Netsh

Needs: Compatible OpenSSH/Plink authentication or administrative Netsh/IP Helper context; correct listener and destination paths

8.1 Built-in OpenSSH client

REM 8.1 Built-in OpenSSH client
where ssh.exe
ssh.exe -V
ssh.exe -N -R 127.0.0.1:1080 KALI_USER@LHOST -p KALI_SSH_PORT -o ExitOnForwardFailure=yes -o ServerAliveInterval=30

REM Remote fixed forward from Windows to Kali
plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" ^
  -l KALI_USER -pwfile C:\PATH\kali-password.txt ^
  -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT ^
  -P KALI_SSH_PORT LHOST

REM Local dynamic SOCKS on Windows
plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" ^
  -l SSH_USER -pwfile C:\PATH\ssh-password.txt ^
  -D 127.0.0.1:1080 -P SSH_PORT PIVOT

REM Elevated Windows shell
netsh interface portproxy add v4tov4 ^
  listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT ^
  connectaddress=INTERNAL_HOST connectport=INTERNAL_PORT

netsh interface portproxy show all
netstat -ano -p tcp | findstr ":LOCAL_PORT"

REM 8.3 Netsh portproxy
netsh advfirewall firewall add rule name="OSCP Pivot LOCAL_PORT" ^
  dir=in action=allow protocol=TCP localport=LOCAL_PORT

REM Cleanup
netsh interface portproxy delete v4tov4 ^
  listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT

netsh advfirewall firewall delete rule name="OSCP Pivot LOCAL_PORT"

Current Plink supports -L, -R and -D, but not OpenSSH's remote-dynamic shorthand. -batch prevents an unseen prompt from hanging; pair it with a verified -hostkey. -pwfile avoids a literal password in the command line but creates a sensitive file that must be protected and removed. Prefer a key or existing authenticated context where feasible.

portproxy requires an elevated token, forwards TCP rather than UDP, modifies persistent host configuration and may depend on the IP Helper service. A stored rule or listening socket still does not prove the destination is reachable. Record and remove both the proxy and any firewall rule.

Verify → Verify actual listener, route and application, then remove created portproxy/firewall state as appropriate.

If it fails → Missing admin rights blocks Netsh changes without disproving a user-space SSH route; firewall/bind failures are independent. More detail ↓

If → then

A credential appears valid but the destination's usable access is unknown → Match route, destination service and effective authorization
Needs: Real source-to-service route, correct identity context and protocol-specific execution/logon rights
SSH reaches a server that can access the needed internal service → Forward a selected service through an SSH client-side listener
Needs: Accepted SSH identity and forwarding policy; local listener availability and SSH-server-to-destination route
A pivoted exploit reaches its target but its shell/download cannot return → Build the callback and delivery routes separately from the attack route
Needs: Target-to-listener/download-server path, correct advertised address and compatible reverse listener/forward

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Forward from Windows with OpenSSH, Plink or Netsh

USE WHEN: The pivot is Windows and available networking utilities constrain the route
STARTING ACCESS: A pivot identity/process or reachable SSH service and a drawn source-to-destination path
RESULT: A selected TCP service reachable through the Windows pivot

Recognize the clue

From a Windows pivot inspect native/available tunnel utilities, its route to the destination and the rights needed by the selected implementation.

Get-Command ssh,plink,netsh -ErrorAction SilentlyContinue
Get-Service iphlpsvc
Test-NetConnection TARGET -Port PORT

SYNTHETIC EXAMPLE OUTPUT

ssh: available
iphlpsvc: Running
Destination TcpTestSucceeded: True
Administrative portproxy right: not yet known

Means: Windows has a carrier/destination candidate; Netsh administrative state and user-space SSH requirements differ.

Confirm: Choose the supported tool, verify listener/bind/firewall and correct connection direction; check its exact rights.

After validation: The selected implementation carries the application and cleanup state is known: use it.
Ruled out in this context: No admin rights for portproxy rules out that Netsh route, not a valid user-space SSH option.
Still inconclusive: A running IP Helper service alone does not establish permission or a working forward.

Troubleshooting: Missing admin rights blocks Netsh changes without disproving a user-space SSH route; firewall/bind failures are independent.

8.1 Built-in OpenSSH client

The same -L, -D, -R, ProxyJump and ProxyCommand concepts apply to current Windows OpenSSH. Remote dynamic forwarding depends on the client version.

8.2 Plink

Remote fixed forward from Windows to Kali:

Local dynamic SOCKS on Windows:

Current Plink supports -L, -R and -D, but not OpenSSH's remote-dynamic shorthand. -batch prevents an unseen prompt from hanging; pair it with a verified -hostkey. -pwfile avoids a literal password in the command line but creates a sensitive file that must be protected and removed. Prefer a key or existing authenticated context where feasible.

8.3 Netsh portproxy

Elevated Windows shell:

If the existing firewall policy does not already allow the listener and a change is authorized:

Cleanup:

portproxy requires an elevated token, forwards TCP rather than UDP, modifies persistent host configuration and may depend on the IP Helper service. A stored rule or listening socket still does not prove the destination is reachable. Record and remove both the proxy and any firewall rule.

Why it works

OpenSSH/Plink carry SSH tunnels; Netsh portproxy provides a fixed TCP mapping and does not authenticate to the destination. Their rights and service prerequisites differ.

Worked example · hypothetical

Observation: a Windows pivot can reach an internal service. Test: choose an available method whose privilege and direction conditions hold. Illustrative output: the selected forward carries the application's handshake. Interpretation: test destination authorization independently.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗