plink
PuTTY's command-line SSH client, for tunnels from Windows.
The command-line version of PuTTY's SSH client. In a pivot its role is clear: when the compromised host is Windows and ships no SSH client, you upload `plink.exe` and use it to set up a **remote port forward** to the attacking machine, exposing an internal service (RDP, SMB) on a port of the attacker. It is the classic piece for bringing an internal 3389 out from an old Windows box. It takes the password on the line itself with `-pw`, convenient but visible in logs.
Family Pivoting & tunnelling
Flags -l -pw -R -L -N
Concepts Remote Port Forwarding, Local port forwarding (SSH tunnel)
Cheatsheet Windows redirectors & exotic tunnels
Installation
# ships with PuTTY (plink.exe); upload it to the Windows victimUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.