Port Forwarding with netsh (portproxy)

netsh interface portproxy is the native way to turn a compromised Windows host into a pivot without uploading third-party tools, which lowers the risk of detection. It forwards a port the pivot listens on to an internal IP and port, so from our attacking machine we reach services on a segment the pivot has a route to (for example, the RDP of a domain controller) but we do not.

Mechanism

Create the forwarding rule: the pivot will listen on 8080 and send everything to 3389 on the internal host:

netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=3389 connectaddress=<internal-ip>

Confirm the rule exists:

netsh.exe interface portproxy show v4tov4

Listen on ipv4:             Connect to ipv4:

Address         Port        Address         Port
--------------- ----------  --------------- ----------
0.0.0.0         8080        172.16.5.25     3389

If the pivot's firewall blocks the listen port, open an inbound rule:

netsh advfirewall firewall add rule name="fwd" dir=in action=allow protocol=TCP localport=8080

From the attacking machine, connect to the pivot's port and it routes to the internal target:

xfreerdp /v:<pivot-ip>:8080 /u:<user> /p:<pass>

When finished, clean up the rule:

netsh.exe interface portproxy delete v4tov4 listenport=8080 listenaddress=0.0.0.0

Requirements

portproxy requires administrator privileges on the pivot and relies on the IP Helper service (iphlpsvc). The pivot must have an interface or route to the internal target, and the firewall must allow the inbound connection to the listen port. Unlike an SSH or Chisel tunnel, no SOCKS proxy is created here: it is a port-to-port forward, one per service.

How to detect it

The pivot is given away by new portproxy rules (visible with netsh interface portproxy show all or in the HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp key), firewall rules added from the command line, connections to unusual ports on the host that get forwarded to other segments, and the execution of netsh.exe with portproxy parameters (event 4688).

Defence. Restrict local administrator rights; segment the network so a workstation has no route to critical servers; alert on the creation of portproxy and firewall rules; and watch netsh.exe with EDR. Related to local port forwarding, dynamic port forwarding, Chisel pivoting, socat relay and RDP session hijacking.