SocksOverRDP Pivoting (double hop over RDP)

When the pivot only lets us reach the next segment over RDP (for example, a Windows network with no SSH), we can tunnel arbitrary traffic inside the Remote Desktop session itself. SocksOverRDP uses RDP Dynamic Virtual Channels (DVC), the same mechanism that carries the clipboard or audio, to open a SOCKS proxy over the encrypted RDP channel. This lets us chain hops (our host, a first server, and from it a third) without uploading our own tunnel or opening new ports: everything travels as if it were legitimate RDP.

Mechanism

On the first host (the one we reach over RDP) we register the client plugin with regsvr32.exe. From then on, every new outbound RDP session offers a local SOCKS listener on 127.0.0.1:1080:

regsvr32.exe SocksOverRDP-Plugin.dll

From that first host we open an RDP session with mstsc.exe toward the second host and, once inside, we run the server with administrator privileges to bring up the channel:

SocksOverRDP-Server.exe

Back on the first host, we confirm the SOCKS listener is up:

netstat -antb | findstr 1080

TCP    127.0.0.1:1080         0.0.0.0:0              LISTENING

To make our tools use that SOCKS, we route traffic to 127.0.0.1:1080 with Proxifier (a SOCKS proxy for Windows GUI clients such as mstsc.exe) or, if we operate from Linux with the port re-exposed, with proxychains pointing at the pivot's SOCKS:

# /etc/proxychains.conf on the attacker (first pivot's SOCKS)
socks5 <pivot-ip> 1080

A common trick is to re-expose the pivot's local 1080 with netsh so it can be reached from outside:

netsh interface portproxy add v4tov4 listenport=1080 listenaddress=0.0.0.0 connectport=1080 connectaddress=127.0.0.1

Requirements

Valid RDP access to the first host, permission to register the DLL (regsvr32 does not require administrator for HKCU, but SocksOverRDP-Server.exe on the target does run as administrator) and Remote Desktop available along the chain. Since these are third-party binaries, it is best to stage them with the system's own tools and expect that an EDR may flag them.

How to detect it. The pattern gives it away: an unknown DLL loaded via regsvr32.exe followed by a SocksOverRDP-Server or Proxifier process, and above all server-to-server chained RDP sessions (a server starting outbound RDP to another is anomalous). On the network, legitimate RDP should not carry proxy-like traffic volumes. Also watch for new netsh interface portproxy rules and local listeners on 1080.

Defence. Restrict RDP with the firewall and with Restricted Admin; limit unneeded DVCs by policy; disallow server-to-server RDP except through a controlled admin jump host; and monitor regsvr32 loading DLLs outside system paths. It is a cousin of Chisel pivoting, native netsh forwarding and Ligolo-ng pivoting, and relies on the RDP access of the first hop.