Netsh — Windows Port Forwarding (portproxy)
netsh is a built-in Windows network shell. interface portproxy forwards TCP ports on the pivot to internal hosts — no binary upload required.
Ctrl+F:
netsh·portproxy·v4tov4·listenport·connectaddress· firewall
OSCP use: Admin shell on Windows pivot, can’t upload tools →
netsh interface portproxy add v4tov4relays traffic from pivot:PORT to internal host. Pair with firewall rule if blocked.
Requires: Administrator privileges on the Windows pivot.
📌 Add Port Forward Rules
REM Syntax
netsh interface portproxy add v4tov4 listenport=LISTEN connectaddress=TARGET connectport=DEST [listenaddress=0.0.0.0]
REM Relay pivot:8080 → internal web 172.16.0.10:80
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.10
REM Relay RDP to internal host
netsh interface portproxy add v4tov4 listenport=3389 listenaddress=0.0.0.0 connectport=3389 connectaddress=172.16.0.10
REM Relay SMB
netsh interface portproxy add v4tov4 listenport=445 listenaddress=0.0.0.0 connectport=445 connectaddress=172.16.0.10On Kali — connect to pivot IP, not internal IP:
curl http://PIVOT_IP:8080
gobuster dir -u http://PIVOT_IP:8080 -w wordlist.txt
xfreerdp3 /u:admin /p:password /v:PIVOT_IP
crackmapexec smb PIVOT_IP -u admin -p password📌 View & Manage Rules
netsh interface portproxy show all
netsh interface portproxy show v4tov4
REM Delete one rule
netsh interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0
REM Remove all portproxy rules
netsh interface portproxy reset📌 Firewall — Allow Inbound Port
Portproxy alone may not open the firewall:
REM Allow inbound TCP on forwarded port
netsh advfirewall firewall add rule name="Pivot 8080" protocol=TCP dir=in localport=8080 action=allow
REM Remove when done
netsh advfirewall firewall delete rule name="Pivot 8080"📌 Full OSCP Example
REM Pivot: 10.10.10.5 (reachable from Kali)
REM Internal: 172.16.0.10:80 (only from pivot)
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.10
netsh advfirewall firewall add rule name="Pivot" protocol=TCP dir=in localport=8080 action=allow# Kali
curl http://10.10.10.5:8080
nmap -sT -p 8080 10.10.10.5📌 Netsh vs Other Windows Pivot Tools
| Tool | Binary upload? | Admin? | Best for |
|---|---|---|---|
| netsh portproxy | No (built-in) | Yes | Single-port relay, locked-down pivot |
| Plink | Yes (plink.exe) | User + SSH to Kali | SSH tunnels, SOCKS, reverse forward |
| Socat | Yes (socat.exe) | User | Multi-connection relay (fork) |
| Ligolo-ng | Yes (agent.exe) | User | Full subnet TUN pivot |
| Chisel | Yes | User | HTTP/SOCKS through firewalls |
No binary upload possible? → netsh or built-in ssh.exe — Windows Tunneling > 📌 Decision Guide — No Binary Upload Possible?
📌 Quick Cheat Sheet
netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.0.10
netsh advfirewall firewall add rule name="Pivot" protocol=TCP dir=in localport=8080 action=allow
netsh interface portproxy show all
netsh interface portproxy reset